@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/SeamsWeb/SeamsWeb.js

@@ -1,1918 +0,0 @@
-import { isUserCancellationError, toError } from "../shared-ts/src/utils/errors.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { MinimalNearClient } from "../core/rpcClients/near/NearClient.js";
-import { cloneAuthenticatorOptions } from "../shared-ts/src/utils/authenticatorOptions.js";
-import { sha256HexUtf8 } from "../shared-ts/src/utils/digests.js";
-import { resolvePrimaryNearRpcUrl } from "../core/config/chains.js";
-import { resolveAppearanceTheme, resolveThemePalette } from "../core/config/configHelpers.js";
-import { buildConfigsFromEnv } from "../core/config/defaultConfigs.js";
-import { parseMpcMaterialActivationRef, parseWalletAuthMethodId } from "../shared-ts/src/utils/domainIds.js";
-import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
-import { createServerAllocatedWalletId } from "../shared-ts/src/utils/registrationIds.js";
-import { configuredThresholdEcdsaChainTargets, nearAccountRefFromAccountId, thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetsEqual, toWalletId, walletSessionRefFromSession } from "../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { nearAccountBindingFromRaw } from "../shared-ts/src/utils/walletCapabilityBindings.js";
-import { parseExactEcdsaSigningLaneIdentity, parseExactEd25519ExportMaterialIdentity } from "../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
-import { parseLinkedDeviceApprovalResultV1 } from "../shared-ts/src/device-linking/parsers.js";
-import "../shared-ts/src/device-linking/index.js";
-import { RegistrationEventPhase, UnlockEventPhase, createRegistrationFlowEvent, createUnlockFlowEvent } from "../core/types/sdkSentEvents.js";
-import { WalletSessionStatusReadScope } from "../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { readNearProvisioningState } from "../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
-import { isRegistrationBenchmarkDiagnosticsEnabled } from "../core/signingEngine/walletCustody/ceremonyDriver.js";
-import { walletSessionAuthorizations } from "../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { IndexedDBManager } from "../core/indexedDB/index.js";
-import { IndexedDbEcdsaCapabilityManifestStore } from "../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
-import { resolveLinkedEcdsaHolderRuntimeV1 } from "../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
-import { activateEmailOtpWalletAfterUnlock, persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock } from "./operations/authMethods/emailOtp/walletActivation.js";
-import { __isWalletIframeHostMode } from "../core/browser/walletIframe/host-mode.js";
-import { readUnlockedEd25519ExportRootLinkingCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
-import { resolveAmbiguousEcdsaActivationForSelectedAuthMethod } from "./assembly/browserSigningSurfaceAssembly.js";
-import { BrowserSigningSurface } from "./signingSurface/BrowserSigningSurface.js";
-import { WALLET_IFRAME_TRANSPORT_TIMING_LABEL } from "./operations/registration/registrationTiming.js";
-import { resumePendingEcdsaRegistrationFromStoredCommit, resumePendingNearRegistrations } from "./operations/registration/pendingRegistrationRecovery.js";
-import { showWalletRecoveryCodesUi } from "./operations/recovery/walletRecoveryCodeBackup.js";
-import { pendingWalletRecoveryCodeBackupRepository } from "../core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.js";
-import { requestEmailOtpChallenge, requestEmailOtpEnrollmentChallenge, resolveGoogleEmailOtpProvider } from "./operations/authMethods/emailOtp/challenge.js";
-import { addWalletSigner, registerWallet } from "./operations/registration/registration.js";
-import { resumePendingWalletRecoveries } from "./operations/recovery/walletRecoveryCommit.js";
-import { addPasskeyWalletAuthMethod } from "./operations/authMethods/passkey/addPasskey.js";
-import { revokeWalletAuthMethodOperation } from "./operations/authMethods/revokeAuthMethod.js";
-import { addEmailOtpWalletAuthMethod } from "./operations/authMethods/emailOtp/addEmailOtp.js";
-import { WalletIframeCoordinator } from "./walletIframe/coordinator.js";
-import { parseWalletIframeExactSessionIdentity } from "./walletIframe/shared/exactSessionState.js";
-import { resolveBrowserWorkerWarmupPolicy } from "./assembly/browserWorkerWarmupPolicy.js";
-import { configureBrowserIndexedDB } from "./assembly/configureBrowserIndexedDB.js";
-import { createBrowserHostPlatformRuntime, createBrowserSigningRuntime } from "./assembly/createBrowserSigningRuntime.js";
-import { scheduleRestoredSessionPresignaturePrefills } from "./walletIframe/host/restoredSessionPresignaturePrefill.js";
-import { createBrowserSigningStores } from "./assembly/createBrowserSigningStores.js";
-import { initializeBrowserSigningRuntime } from "./assembly/initializeBrowserSigningRuntime.js";
-import { assertWalletRuntimePostconditions } from "../core/signingEngine/session/postconditions/runtimePostconditions.js";
-import { resolveExactLinkedEmailOtpAuthority, resolveLinkedDeviceEmailOtpAuthoritySelection, unlockLinkedDeviceEmailOtpWallet } from "./operations/auth/login.js";
-import { getWalletSessionDomain, prefillRouterAbEcdsaDerivationPresignaturePoolDomain } from "./operations/auth/walletAuth.js";
-import { LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1 } from "./operations/devices/deviceLinkingHttpTransport.js";
-import { createWalletIframeLinkedDeviceManagementPortV1 } from "./publicApi/devices.js";
-import { resolveConfiguredChainTarget } from "./publicApi/chainTargets.js";
-import { buildNearWalletRegistrationSignerSetSelection, resolvePasskeyRegistrationAccountProvisioning } from "./operations/registration/registrationSignerSet.js";
-import { requireTempoFeeTokenPreferenceSigningRequest } from "../core/signingEngine/chains/tempo/feeToken.js";
-import { createPublicApi } from "./publicApi/createPublicApi.js";
-import { createWalletHostOwnerAuthoritiesV1 } from "./operations/devices/walletHostOwnerAuthority.js";
-import { createWalletHostCompositionV1 } from "./operations/devices/walletHostComposition.js";
-import { createDeviceLinkingEcdsaSourceContributionMetadataReaderV1, createDeviceLinkingEd25519SourceContributionPortV1, createDeviceLinkingSourceContributionPortV1 } from "../core/signingEngine/workerManager/deviceLinkingSourceContribution.js";
-import { beginGoogleEmailOtpWalletAuth } from "./operations/authMethods/emailOtp/googleEmailOtpWalletAuthFlow.js";
-import { acknowledgeWalletRecoveryBackup, readWalletRecoveryCodeStatus, requestWalletCustodyEmailOtpChallenge } from "../core/rpcClients/relayer/walletRecoveryRotate.js";
-import { rotateWalletRecoveryCodes } from "./operations/recovery/walletRecoveryRotation.js";
-//#region src/SeamsWeb/SeamsWeb.ts
-async function googleEmailOtpUnlockExecution(provenance, walletAuthMethodId) {
-	if (provenance.kind === "device_link") return "authority";
-	const pendingRows = await IndexedDBManager.listPendingWalletRegistrationCommits();
-	for (const pending of pendingRows) if (pending.operation === "near_provisioning" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletAuthMethodId === walletAuthMethodId) return "authority";
-	return "ordinary";
-}
-function requireWalletAuthMethodId(value) {
-	const parsed = parseWalletAuthMethodId(value);
-	if (!parsed.ok) throw new Error("Email OTP unlock returned an invalid wallet auth method id");
-	return parsed.value;
-}
-function exactEmailOtpAuthorityRefFromLoginResult(result) {
-	const authority = result.recovery.verifiedAuthorityProjection.authority;
-	const authorityRef = parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: authority.walletId,
-		walletAuthMethodId: result.authorization.record.authMethodId,
-		authorityDigest: authority.authorityDigestB64u
-	});
-	if (!authorityRef) throw new Error("Email OTP unlock returned an invalid authority reference");
-	return authorityRef;
-}
-function nowMs() {
-	return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
-}
-function createEmailOtpUnlockTimings() {
-	return {
-		emailOtpProofVerificationMs: 0,
-		walletUnlockExchangeMs: 0,
-		ecdsaMaterialRestoreMs: 0,
-		signingSessionSealApplyMs: 0,
-		warmCapabilityPersistenceMs: 0,
-		activeRuntimeConstructionMs: 0,
-		emailHashLookupMs: 0,
-		workerUnlockAndSessionBootstrapMs: 0,
-		walletStateActivationMs: 0,
-		runtimePostconditionMs: 0,
-		walletIframeRoundTripMs: 0
-	};
-}
-function recordEmailOtpUnlockTiming(timings, bucket, startedAtMs) {
-	addEmailOtpUnlockTiming(timings, bucket, nowMs() - startedAtMs);
-}
-function recordEmailOtpUnlockElapsedTiming(timings, bucket, durationMs) {
-	addEmailOtpUnlockTiming(timings, bucket, durationMs);
-}
-function addEmailOtpUnlockTiming(timings, bucket, durationMs) {
-	const deltaMs = Math.max(0, Math.round(durationMs));
-	timings[bucket] += deltaMs;
-	if (!isEmailOtpUnlockDiagnosticsEnabled()) return;
-	console.info("[EmailOtpUnlock] timing", {
-		bucket,
-		deltaMs,
-		accumulatedMs: timings[bucket]
-	});
-}
-function isEmailOtpUnlockDiagnosticsEnabled() {
-	return Reflect.get(globalThis, "__SEAMS_EMAIL_OTP_UNLOCK_DIAGNOSTICS") === true;
-}
-function logEmailOtpUnlockTimingSummary(input) {
-	if (!isEmailOtpUnlockDiagnosticsEnabled()) return;
-	const topBuckets = Object.entries(input.timings).filter(([, durationMs]) => durationMs > 0).sort((left, right) => right[1] - left[1]).slice(0, 5).map(([bucket, durationMs]) => ({
-		bucket,
-		durationMs
-	}));
-	const errorMessage = input.error instanceof Error ? input.error.message : input.error ? String(input.error) : "";
-	const summary = {
-		kind: "email_otp_unlock_timing_summary_v1",
-		status: input.status,
-		mode: input.mode,
-		walletId: input.walletId,
-		prewarm: input.prewarm,
-		...input.chainTarget ? { chainTarget: input.chainTarget } : {},
-		totalElapsedMs: Math.max(0, Math.round(nowMs() - input.startedAtMs)),
-		timings: input.timings,
-		topBuckets,
-		...errorMessage ? { errorMessage } : {}
-	};
-	console.info("[EmailOtpUnlock] timing summary", summary);
-}
-function emailOtpUnlockPrewarmScopeFromBinding(nearAccountBinding) {
-	if (!nearAccountBinding) return { kind: "global" };
-	return {
-		kind: "near_account_bound",
-		walletId: String(nearAccountBinding.wallet.walletId),
-		nearAccountId: String(nearAccountBinding.nearAccountId)
-	};
-}
-function emailOtpUnlockPrewarmRequestFromOptions(opts) {
-	if (opts?.iframe) return { kind: "iframe_and_local_resources" };
-	if (opts?.workers) return { kind: "local_worker_resources" };
-	return null;
-}
-function emailOtpUnlockPrewarmSnapshot(args) {
-	if (args.record.kind === "none") return { kind: "not_prewarmed" };
-	const scope = args.record.scope;
-	return {
-		kind: "prewarm_attempted",
-		status: args.record.status,
-		completedAtMs: args.record.completedAtMs,
-		ageMs: Math.max(0, Math.round(args.nowMs - args.record.completedAtMs)),
-		request: args.record.request,
-		scope,
-		walletMatches: scope.kind === "global" || scope.walletId === args.walletId
-	};
-}
-function emailOtpUnlockActiveRuntimeState(inventory) {
-	return {
-		kind: "email_otp_unlock_active_runtime_state_v1",
-		inventory
-	};
-}
-function buildEmailOtpEcdsaUnlockActivationPlan(args) {
-	if (args.result.authorization.record.walletId !== args.walletSession.walletId) throw new Error("Email OTP unlock authorization does not match the wallet session");
-	return {
-		kind: "email_otp_unlock_activation_plan_v1",
-		mode: "evm_family_ecdsa",
-		activeAuthorization: args.result.authorization,
-		authorizations: args.result.authorizations,
-		runtimeState: emailOtpUnlockActiveRuntimeState(args.runtimeInventory)
-	};
-}
-function logEmailOtpUnlockActivationPlan(plan) {
-	if (!isEmailOtpUnlockDiagnosticsEnabled()) return;
-	console.info("[EmailOtpUnlock] activation plan constructed", {
-		kind: plan.kind,
-		mode: plan.mode,
-		walletId: plan.activeAuthorization.record.walletId,
-		authorityDigest: plan.activeAuthorization.record.authorityDigestB64u,
-		walletSessionIds: plan.authorizations.map((authorization) => authorization.operationCredential.walletSessionId),
-		runtimeTargetCount: plan.runtimeState.inventory.ecdsaByTarget.size
-	});
-}
-function nearAccountBindingKindFromId(nearAccountId) {
-	return nearAccountId.length === 64 && /^[0-9a-f]+$/i.test(nearAccountId) ? "implicit_near_account" : "named_near_account";
-}
-function requireNearAccountBindingForOperation(args) {
-	const walletId = String(args.walletId || "").trim();
-	const nearAccountId = String(args.nearAccountId || "").trim();
-	if (!walletId || !nearAccountId) throw new Error(`[SeamsWeb] ${args.operation} requires walletId and nearAccountId`);
-	const parsed = nearAccountBindingFromRaw({
-		kind: nearAccountBindingKindFromId(nearAccountId),
-		wallet: { walletId },
-		nearAccountId
-	});
-	if (!parsed.ok) throw new Error(`[SeamsWeb] ${args.operation} requires a valid NEAR account binding`);
-	return parsed.value;
-}
-function resolvePrewarmNearAccountBinding(opts) {
-	const walletId = String(opts?.walletId || "").trim();
-	const nearAccountId = String(opts?.nearAccountId || "").trim();
-	if (!walletId && !nearAccountId) return void 0;
-	return requireNearAccountBindingForOperation({
-		walletId,
-		nearAccountId,
-		operation: "prewarm"
-	});
-}
-function requireConcreteEcdsaChainTarget(value, operation) {
-	if (!isObject(value)) throw new Error(`[SeamsWeb] ${operation} requires a concrete ECDSA chainTarget`);
-	return thresholdEcdsaChainTargetFromRequest(value);
-}
-function normalizeResolveExactKeyExportLaneInput(input) {
-	switch (input.kind) {
-		case "ecdsa": return {
-			kind: "ecdsa",
-			walletSession: walletSessionRefFromSession(input.walletSession),
-			chainTarget: thresholdEcdsaChainTargetFromRequest(input.chainTarget)
-		};
-		case "ed25519": return {
-			kind: "ed25519",
-			walletSession: walletSessionRefFromSession(input.walletSession),
-			nearAccount: nearAccountRefFromAccountId(input.nearAccount.accountId)
-		};
-	}
-}
-function normalizeResolveExactKeyExportLaneResult(result) {
-	switch (result.kind) {
-		case "relink_required": return {
-			kind: "relink_required",
-			reason: result.reason
-		};
-		case "ecdsa": return {
-			kind: "ecdsa",
-			laneIdentity: parseExactEcdsaSigningLaneIdentity(result.laneIdentity)
-		};
-		case "ed25519": {
-			const materialActivation = parseMpcMaterialActivationRef(result.materialActivation);
-			if (!materialActivation.ok) throw new Error(materialActivation.error.message);
-			return {
-				kind: "ed25519",
-				laneIdentity: parseExactEd25519ExportMaterialIdentity(result.laneIdentity),
-				materialActivation: materialActivation.value
-			};
-		}
-	}
-}
-function normalizeExportKeypairWithUIInput(input, theme) {
-	const resolvedOptions = {
-		...input.options,
-		theme: input.options.theme ?? theme
-	};
-	switch (input.kind) {
-		case "ecdsa": {
-			const laneIdentity = parseExactEcdsaSigningLaneIdentity(input.laneIdentity);
-			if (String(laneIdentity.signer.walletId) !== String(input.walletSession.walletId)) throw new Error("[SeamsWeb] key export lane wallet does not match wallet session");
-			if (!thresholdEcdsaChainTargetsEqual(laneIdentity.signer.chainTarget, input.chainTarget)) throw new Error("[SeamsWeb] key export lane chain target does not match request target");
-			return {
-				kind: "ecdsa",
-				chainTarget: input.chainTarget,
-				walletSession: input.walletSession,
-				laneIdentity,
-				options: resolvedOptions
-			};
-		}
-		case "ed25519": {
-			const laneIdentity = parseExactEd25519ExportMaterialIdentity(input.laneIdentity);
-			const materialActivation = parseMpcMaterialActivationRef(input.materialActivation);
-			if (!materialActivation.ok) throw new Error(materialActivation.error.message);
-			if (String(laneIdentity.signer.account.wallet.walletId) !== String(input.walletSession.walletId)) throw new Error("[SeamsWeb] Ed25519 export lane wallet does not match wallet session");
-			if (String(laneIdentity.signer.account.nearAccountId) !== String(input.nearAccount.accountId)) throw new Error("[SeamsWeb] Ed25519 export lane does not match the NEAR account");
-			return {
-				kind: "ed25519",
-				nearAccount: nearAccountRefFromAccountId(input.nearAccount.accountId),
-				walletSession: input.walletSession,
-				laneIdentity,
-				materialActivation: materialActivation.value,
-				options: resolvedOptions
-			};
-		}
-	}
-}
-function resolveRuntimeAppearance(current, input) {
-	const rawInput = input;
-	return {
-		theme: resolveAppearanceTheme({
-			value: rawInput.theme,
-			fallback: current.theme,
-			legacyTokens: rawInput.tokens
-		}),
-		palette: resolveThemePalette({
-			value: rawInput.palette,
-			fallback: current.palette
-		})
-	};
-}
-function resolveSeamsWebRuntimeMode(internalOptions) {
-	if (internalOptions?.kind === "wallet_host") return "wallet_host";
-	return "application";
-}
-function resolveSeamsWebLifecycleEventSource(args) {
-	switch (args.mode) {
-		case "wallet_host": return {
-			kind: "signing_engine",
-			source: args.signingEngine
-		};
-		case "application": return {
-			kind: "wallet_iframe",
-			source: args.walletIframe
-		};
-	}
-}
-function subscribeToSeamsWebLifecycleEvents(eventSource, listener) {
-	switch (eventSource.kind) {
-		case "signing_engine":
-		case "wallet_iframe": return eventSource.source.onSdkLifecycleEvent(listener);
-	}
-}
-function deliverNearProvisioningStateChanged(listener, event) {
-	if (event.event === "registration.near_provisioning_changed") listener(event);
-}
-function reportWalletRecoveryStartupResult(result) {
-	switch (result.kind) {
-		case "completed": return;
-		case "pending":
-			console.warn("[SeamsWeb] pending wallet recovery replay remains pending:", result.recoveryOperationId, result.failure);
-			return;
-		case "discarded":
-			console.warn("[SeamsWeb] pending wallet recovery was refused and discarded:", result.recoveryOperationId);
-			return;
-		case "corrupt":
-			console.warn("[SeamsWeb] pending wallet recovery replay record is corrupt:", result.recoveryOperationId);
-			return;
-	}
-}
-const ecdsaCapabilityManifestStore = new IndexedDbEcdsaCapabilityManifestStore();
-function createSeamsWebDeviceDomainV1(args) {
-	switch (args.mode) {
-		case "application": return {
-			domain: {
-				kind: "iframe",
-				linkedDeviceManagement: createWalletIframeLinkedDeviceManagementPortV1({ walletIframe: args.walletIframe })
-			},
-			resumePendingAcknowledgementsV1: noopDeviceLinkingAcknowledgementResumeV1,
-			dispose: noopDeviceLinkingDisposeV1
-		};
-		case "wallet_host": {
-			const composition = createWalletHostCompositionV1({
-				authenticator: args.platform.authenticator,
-				http: args.platform.http,
-				relayerUrl: String(args.configs.network.relayer?.url || "").trim(),
-				publishableKey: args.configs.registration.publishableKey,
-				projectEnvironmentId: args.configs.registration.projectEnvironmentId,
-				ownerRequest: args.ownerAuthorities.ownerRequest,
-				ownerApprovalUpdates: createWalletHostOwnerApprovalUpdatesV1({
-					request: args.ownerAuthorities.ownerRequest,
-					pollIntervalMs: 1e3
-				}),
-				ownerAuthorization: args.ownerAuthorities.ownerAuthorization,
-				sourceContribution: args.sourceContribution,
-				custodyCeremonyTransport: walletCustodyCeremonyTransportFromWorkerContextV1(args.signingEngine.getSignerWorkerContext()),
-				managementRequest: args.ownerAuthorities.managementRequest,
-				nowMs: Date.now,
-				pollIntervalMs: 1e3
-			});
-			return {
-				domain: {
-					kind: "direct",
-					linkedDeviceManagement: composition.linkedDeviceManagement,
-					deviceLinkingPorts: composition.deviceLinkingPorts
-				},
-				resumePendingAcknowledgementsV1: composition.deviceLinkingPorts.resumePendingAcknowledgementsV1,
-				dispose: composition.dispose
-			};
-		}
-	}
-}
-function noopDeviceLinkingDisposeV1() {}
-async function noopDeviceLinkingAcknowledgementResumeV1() {}
-function resumeDeviceLinkingAcknowledgementsInBackgroundV1(resume) {
-	resume().catch(reportDeviceLinkingAcknowledgementResumeFailureV1);
-}
-function reportDeviceLinkingAcknowledgementResumeFailureV1(error) {
-	console.warn("[SeamsWeb] pending linked-device acknowledgement replay failed:", error instanceof Error ? error.message : String(error || "unknown error"));
-}
-function createWalletHostOwnerApprovalUpdatesV1(args) {
-	return {
-		getApprovalV1: async (input) => await requestWalletHostApprovalV1(args.request, input),
-		subscribeApprovalV1: async (input) => createWalletHostApprovalSubscriptionV1({
-			...args,
-			input
-		})
-	};
-}
-function createWalletHostEcdsaSourceContributionMetadataReaderV1(args) {
-	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({
-		readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
-			const authentication = args.signingEngine.readWalletAuthenticationState();
-			if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
-			let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-				walletId: authentication.walletId,
-				materialActivation
-			});
-			if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-				walletId: authentication.walletId,
-				materialActivation,
-				authorities: lookup.authorities
-			});
-			if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
-			return lookup.manifest;
-		},
-		readLinkedEcdsaHolderV1: ({ materialActivation }) => {
-			const authentication = args.signingEngine.readWalletAuthenticationState();
-			if (authentication.kind !== "authenticated") return null;
-			return resolveLinkedEcdsaHolderRuntimeV1({
-				walletId: authentication.walletId,
-				materialActivation
-			});
-		}
-	});
-}
-function createWalletHostDeviceDomainConstructionV1(args) {
-	const relayerUrl = String(args.configs.network.relayer?.url || "").trim();
-	const platform = createBrowserHostPlatformRuntime(args.signingEngine.getSignerWorkerContext());
-	const ownerAuthorities = createWalletHostOwnerAuthoritiesV1({
-		http: platform.http,
-		relayerUrl,
-		walletSessions: walletSessionAuthorizations,
-		resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
-		readWalletAuthenticationState: args.signingEngine.readWalletAuthenticationState.bind(args.signingEngine),
-		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedEd25519ExportRootLinkingCapabilityV1
-	});
-	return {
-		platform,
-		ownerAuthorities,
-		sourceContribution: createWalletHostDeviceLinkingSourceContributionPortV1({
-			signingEngine: args.signingEngine,
-			ownerRequest: ownerAuthorities.ownerRequest,
-			readEcdsaMetadataV1: createWalletHostEcdsaSourceContributionMetadataReaderV1({ signingEngine: args.signingEngine })
-		})
-	};
-}
-function createWalletHostDeviceLinkingSourceContributionPortV1(args) {
-	const workerContext = args.signingEngine.getSignerWorkerContext();
-	return createDeviceLinkingSourceContributionPortV1({
-		workerContext,
-		ed25519: createDeviceLinkingEd25519SourceContributionPortV1({
-			workerContext,
-			executeSourcePreservingV1: async ({ linkSessionId, targetRequestJson, authentication }) => {
-				const response = await args.ownerRequest.requestOwnerV1({
-					method: "POST",
-					canonicalPath: `${LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1}/${String(linkSessionId)}/source-contribution/execute`,
-					body: JSON.parse(targetRequestJson),
-					authentication
-				});
-				if (response.status < 200 || response.status >= 300) throw new Error(`Wallet-host Ed25519 source-preserving request failed with HTTP ${response.status}`);
-				return response.body;
-			}
-		}),
-		readEcdsaMetadataV1: args.readEcdsaMetadataV1
-	});
-}
-async function requestWalletHostApprovalV1(request, input) {
-	const response = await request.requestOwnerV1({
-		method: "GET",
-		canonicalPath: `${LINKED_DEVICE_SESSION_HTTP_BASE_PATH_V1}/${String(input.linkSessionId)}/approval`,
-		authentication: input.authentication
-	});
-	if (response.status < 200 || response.status >= 300) throw new Error(`Wallet-host approval request failed with HTTP ${response.status}`);
-	return parseLinkedDeviceApprovalResultV1(response.body);
-}
-function createWalletHostApprovalSubscriptionV1(args) {
-	let closed = false;
-	let timer = null;
-	const poll = async () => {
-		if (closed) return;
-		try {
-			const result = await requestWalletHostApprovalV1(args.request, args.input);
-			if (!closed) args.input.onResult(result);
-		} catch {}
-		if (!closed) timer = setTimeout(() => void poll(), args.pollIntervalMs);
-	};
-	poll();
-	return { close: () => {
-		closed = true;
-		if (timer) clearTimeout(timer);
-		timer = null;
-	} };
-}
-/**
-* Main SeamsWeb class that provides framework-agnostic passkey operations
-* with flexible event-based callbacks for custom UX implementation
-*/
-var SeamsWeb = class {
-	constructor(configs, nearClient, internalOptions) {
-		this.emailOtpUnlockPrewarmRecord = { kind: "none" };
-		this.configs = buildConfigsFromEnv(configs, { ...internalOptions?.kind === "wallet_host" ? { allowDirectWalletMode: "wallet_host" } : {} });
-		configureBrowserIndexedDB(this.configs);
-		this.nearClient = nearClient || new MinimalNearClient(resolvePrimaryNearRpcUrl(this.configs.network.chains));
-		const browserSigningStores = createBrowserSigningStores(IndexedDBManager);
-		const browserSigningSurface = new BrowserSigningSurface(this.configs, this.nearClient, {
-			managerStores: browserSigningStores.managerStores,
-			signingEngineStores: browserSigningStores.signingEngineStores,
-			sealedSigningSessionStore: browserSigningStores.sealedSigningSessionStore,
-			ed25519YaoPublicCapabilityReferences: browserSigningStores.ed25519YaoPublicCapabilityReferences,
-			createRuntime: createBrowserSigningRuntime,
-			initializeRuntime: initializeBrowserSigningRuntime,
-			workerWarmupPolicy: resolveBrowserWorkerWarmupPolicy(this.configs)
-		});
-		this.signingEngine = browserSigningSurface;
-		this.appearance = this.configs.ui.appearance;
-		this.theme = this.appearance.theme.mode;
-		try {
-			this.signingEngine.setAppearance(this.appearance);
-		} catch {}
-		const userPreferences = this.signingEngine.getUserPreferences();
-		this.walletIframe = new WalletIframeCoordinator({
-			configs: this.configs,
-			signingEngine: this.signingEngine,
-			userPreferences,
-			getAppearance: () => this.appearance
-		});
-		const deviceDomainMode = resolveSeamsWebRuntimeMode(internalOptions);
-		const deviceDomain = deviceDomainMode === "wallet_host" ? createSeamsWebDeviceDomainV1({
-			mode: deviceDomainMode,
-			configs: this.configs,
-			signingEngine: browserSigningSurface,
-			walletIframe: this.walletIframe,
-			...createWalletHostDeviceDomainConstructionV1({
-				configs: this.configs,
-				signingEngine: browserSigningSurface
-			})
-		}) : createSeamsWebDeviceDomainV1({
-			mode: deviceDomainMode,
-			configs: this.configs,
-			signingEngine: browserSigningSurface,
-			walletIframe: this.walletIframe
-		});
-		this.deviceLinkingDispose = deviceDomain.dispose;
-		this.resumePendingAcknowledgementsV1 = deviceDomain.resumePendingAcknowledgementsV1;
-		this.lifecycleEventSource = resolveSeamsWebLifecycleEventSource({
-			mode: resolveSeamsWebRuntimeMode(internalOptions),
-			signingEngine: this.signingEngine,
-			walletIframe: this.walletIframe
-		});
-		const publicApi = createPublicApi({
-			signingEngine: this.signingEngine,
-			nearClient: this.nearClient,
-			configs: this.configs,
-			getTheme: () => this.theme,
-			userPreferences,
-			getWalletIframe: () => this.walletIframe,
-			getWalletAuthDeps: () => this.getWalletAuthDeps(),
-			auth: {
-				requestEmailOtpChallenge: async (args) => await this.requestEmailOtpChallengeDomain(args),
-				requestEmailOtpSigningSessionChallenge: async (args) => await this.requestEmailOtpSigningSessionChallengeDomain(args),
-				refreshEmailOtpSigningSession: async (args) => await this.refreshEmailOtpSigningSessionDomain(args),
-				loginWithEmailOtpEcdsaCapability: async (args) => await this.loginWithEmailOtpEcdsaCapabilityDomain(args),
-				unlockAddedEmailOtpWallet: async (args) => await this.loginWithLinkedEmailOtpWalletDomain(args),
-				beginGoogleEmailOtpWalletAuth: async (args) => await this.beginGoogleEmailOtpWalletAuthDomain(args)
-			},
-			registration: {
-				resumePendingEcdsaRegistration: async (args) => await this.resumePendingEcdsaRegistrationDomain(args),
-				getNearProvisioningState: async (args) => await this.getNearProvisioningStateDomain(args),
-				onNearProvisioningStateChanged: (listener) => subscribeToSeamsWebLifecycleEvents(this.lifecycleEventSource, deliverNearProvisioningStateChanged.bind(null, listener)),
-				addWalletSigner: async (args) => await this.registerWalletSignerDomain(args),
-				addPasskey: async (args) => await this.addPasskeyDomain(args),
-				addEmailOtp: async (args) => await this.addEmailOtpDomain(args),
-				revokeAuthMethod: async (args) => await this.revokeAuthMethodDomain(args),
-				registerWallet: async (args) => await this.registerWalletDomain(args),
-				registerPasskey: async (options) => await this.registerPasskeyDomain(options),
-				requestEmailOtpEnrollmentChallenge: async (args) => await this.requestEmailOtpEnrollmentChallengeDomain(args),
-				enrollEmailOtp: async (args) => await this.enrollEmailOtpDomain(args)
-			},
-			recovery: {
-				getWalletRecoveryCodeStatus: async (args) => await this.getWalletRecoveryCodeStatusDomain(args),
-				acknowledgeWalletRecoveryCodeBackup: async (args) => await this.acknowledgeWalletRecoveryCodeBackupDomain(args),
-				requestWalletCustodyEmailOtpChallenge: async (args) => await this.requestWalletCustodyEmailOtpChallengeDomain(args),
-				rotateWalletRecoveryCodes: async (args) => await this.rotateWalletRecoveryCodesDomain(args)
-			},
-			devices: { ...deviceDomain.domain },
-			keys: {
-				resolveExactKeyExportLane: async (input) => await this.resolveExactKeyExportLaneDomain(input),
-				exportKeypairWithUI: async (input) => await this.exportKeypairWithUIDomain(input)
-			}
-		});
-		this.walletIframeControls = publicApi.walletIframeControls;
-		this.preferences = publicApi.preferences;
-		this.auth = publicApi.auth;
-		this.registration = publicApi.registration;
-		this.recovery = publicApi.recovery;
-		this.devices = publicApi.devices;
-		this.keys = publicApi.keys;
-		this.near = publicApi.near;
-		this.tempo = publicApi.tempo;
-		this.evm = publicApi.evm;
-		this.resumePendingRegistrationOnStartup();
-		resumeDeviceLinkingAcknowledgementsInBackgroundV1(deviceDomain.resumePendingAcknowledgementsV1);
-	}
-	/**
-	* Initialize the hidden wallet service iframe client (optional) and warm critical resources.
-	* Always warms local resources; initializes iframe when wallet mode is `iframe`.
-	* Idempotent and safe to call multiple times.
-	*/
-	async initWalletIframe(walletId) {
-		return await this.walletIframe.init(walletId);
-	}
-	async getWalletIframeExactSessionState() {
-		return await this.walletIframe.getExactSessionState();
-	}
-	/** @internal One wallet-host restore owns all configured-chain prefills. */
-	async prefillRestoredWalletSession(state) {
-		await scheduleRestoredSessionPresignaturePrefills({
-			state,
-			chainTargets: this.configuredChainTargets(),
-			prefill: prefillRouterAbEcdsaDerivationPresignaturePoolDomain.bind(null, this.getWalletAuthDeps())
-		});
-	}
-	async openHostedAuthMenu(request, anchorElement) {
-		return await this.walletIframe.openHostedAuthMenu(request, anchorElement);
-	}
-	async cancelHostedAuthMenu(args) {
-		await this.walletIframe.cancelHostedAuthMenu(args);
-	}
-	onHostedAuthMenuExternalAuthRequest(listener) {
-		return this.walletIframe.onHostedAuthMenuExternalAuthRequest(listener);
-	}
-	onHostedAuthMenuDemoEmailOtpDelivery(listener) {
-		return this.walletIframe.onHostedAuthMenuDemoEmailOtpDelivery(listener);
-	}
-	async resolveHostedAuthMenuExternalAuth(resolution) {
-		await this.walletIframe.resolveHostedAuthMenuExternalAuth(resolution);
-	}
-	async lockWalletIframeExactSession(identity) {
-		const parsedIdentity = parseWalletIframeExactSessionIdentity(identity);
-		return await this.walletIframe.lockExactSession(parsedIdentity);
-	}
-	/** True when the wallet iframe client is connected and ready. */
-	isWalletIframeReady() {
-		return this.walletIframeControls.isWalletIframeReady();
-	}
-	/** Subscribe to wallet iframe ready state transitions. */
-	onWalletIframeReady(listener) {
-		return this.walletIframeControls.onWalletIframeReady(listener);
-	}
-	/** Subscribe to wallet-host login status updates. */
-	onWalletIframeLoginStatusChanged(listener) {
-		return this.walletIframeControls.onWalletIframeLoginStatusChanged(listener);
-	}
-	/** Subscribe to typed lifecycle events emitted by the wallet boundary. */
-	onSdkLifecycleEvent(listener) {
-		return subscribeToSeamsWebLifecycleEvents(this.lifecycleEventSource, listener);
-	}
-	/** Subscribe to wallet-host preference updates. */
-	onWalletIframePreferencesChanged(listener) {
-		return this.walletIframeControls.onWalletIframePreferencesChanged(listener);
-	}
-	getContext() {
-		return {
-			signingEngine: this.signingEngine,
-			nearClient: this.nearClient,
-			configs: this.configs,
-			theme: this.theme,
-			resumePendingAcknowledgementsV1: this.resumePendingAcknowledgementsAfterExactUnlockV1.bind(this)
-		};
-	}
-	resumePendingAcknowledgementsAfterExactUnlockV1() {
-		resumeDeviceLinkingAcknowledgementsInBackgroundV1(this.resumePendingAcknowledgementsV1);
-	}
-	async resumePendingRegistrationOnStartup() {
-		if (IndexedDBManager.isDisabled()) return;
-		const relayerUrl = String(this.configs.network.relayer?.url || "").trim();
-		if (!relayerUrl) return;
-		try {
-			const results = await resumePendingNearRegistrations({ relayerUrl });
-			for (const result of results) if (result.kind === "failed") console.warn("[SeamsWeb] pending registration replay remains pending:", result.registrationCeremonyId, result.error);
-		} catch (error) {
-			console.warn("[SeamsWeb] pending registration startup replay failed:", error instanceof Error ? error.message : String(error || "unknown error"));
-		}
-		try {
-			const recoveryResults = await resumePendingWalletRecoveries({ relayUrl: relayerUrl });
-			for (const result of recoveryResults) reportWalletRecoveryStartupResult(result);
-		} catch (error) {
-			console.warn("[SeamsWeb] pending wallet recovery startup replay failed:", error instanceof Error ? error.message : String(error || "unknown error"));
-		}
-	}
-	dispose() {
-		this.deviceLinkingDispose();
-		this.walletIframe.dispose();
-		this.signingEngine.dispose();
-	}
-	getWalletAuthDeps() {
-		return {
-			getContext: () => this.getContext(),
-			walletIframe: this.walletIframe,
-			signingEngine: this.signingEngine,
-			nearClient: this.nearClient,
-			initWalletIframe: async (walletId) => {
-				return await this.initWalletIframe(walletId);
-			}
-		};
-	}
-	setTheme(next) {
-		if (next !== "light" && next !== "dark") return;
-		this.setAppearance({ theme: {
-			...this.appearance.theme,
-			mode: next
-		} });
-	}
-	/**
-	* Resolve one configured ECDSA chain target by network slug, chain id, or
-	* family — the value every EVM-family signing and export call takes.
-	*
-	* Throws when the selector matches no configured chain, or more than one.
-	* Every configured chain is named in the error, so an ambiguous selector is
-	* a clear failure rather than a silent first-match pick.
-	*
-	* @example seams.chainTarget('tempo-testnet')
-	*/
-	chainTarget(selector) {
-		return resolveConfiguredChainTarget(this.configs.network.chains, selector);
-	}
-	/** Every ECDSA chain target this client is configured for. */
-	configuredChainTargets() {
-		return configuredThresholdEcdsaChainTargets(this.configs.network.chains);
-	}
-	/**
-	* Update resolved appearance at runtime.
-	* This is the canonical internal propagation path for local signing UI,
-	* wallet-host documents, and app-origin wallet iframe mode. Appearance is
-	* excluded from the runtime-reset fingerprint, so warm signing-session state
-	* is preserved. Fire-and-forget; never throws.
-	*/
-	setAppearance(appearance) {
-		const normalizedAppearance = resolveRuntimeAppearance(this.appearance, appearance);
-		this.appearance = normalizedAppearance;
-		this.theme = normalizedAppearance.theme.mode;
-		try {
-			this.signingEngine.setAppearance(normalizedAppearance);
-		} catch {}
-		if (__isWalletIframeHostMode()) try {
-			document.documentElement.setAttribute("data-seams-theme", this.theme);
-		} catch {}
-		if (this.walletIframe.shouldUseWalletIframe()) (async () => {
-			try {
-				await (await this.walletIframe.requireRouter()).setAppearance(normalizedAppearance);
-			} catch {}
-		})();
-	}
-	setWalletIframeSurfaceMeasurementBinding(binding) {
-		this.signingEngine.setWalletIframeSurfaceMeasurementBinding(binding);
-	}
-	/**
-	* Pre-warm resources on a best-effort basis without changing visible state.
-	* - When iframe=true, initializes the wallet iframe client.
-	* - When workers=true, warms local critical resources only outside app-origin iframe mode.
-	* - When both are false/omitted, does nothing.
-	*/
-	async prewarm(opts) {
-		const iframe = !!opts?.iframe;
-		const workers = !!opts?.workers;
-		const nearAccountBinding = resolvePrewarmNearAccountBinding(opts);
-		const prewarmRequest = emailOtpUnlockPrewarmRequestFromOptions(opts);
-		const prewarmScope = emailOtpUnlockPrewarmScopeFromBinding(nearAccountBinding);
-		const tasks = [];
-		if (iframe) tasks.push(this.initWalletIframe(nearAccountBinding?.wallet.walletId));
-		else if (workers && !this.walletIframe.shouldUseWalletIframe()) {
-			const accountContext = nearAccountBinding ? {
-				kind: "near_account_bound",
-				account: nearAccountBinding
-			} : { kind: "none" };
-			tasks.push(this.signingEngine.warmCriticalResources(accountContext));
-			tasks.push(this.signingEngine.prewarmEcdsaRegistrationCrypto());
-		}
-		if (tasks.length === 0) return;
-		let status = "succeeded";
-		try {
-			await Promise.all(tasks);
-		} catch {
-			status = "failed";
-		}
-		if (prewarmRequest) this.emailOtpUnlockPrewarmRecord = {
-			kind: "attempted",
-			status,
-			completedAtMs: Date.now(),
-			request: prewarmRequest,
-			scope: prewarmScope
-		};
-	}
-	emitWalletIframeTransportTimingSummary(input) {
-		if (!isRegistrationBenchmarkDiagnosticsEnabled()) return;
-		const diagnostics = this.walletIframe.getTransportDiagnosticsSnapshot();
-		if (!diagnostics) return;
-		const { kind: transportKind, ...timings } = diagnostics;
-		console.info(WALLET_IFRAME_TRANSPORT_TIMING_LABEL, {
-			kind: "wallet_iframe_registration_transport_timing_v1",
-			operation: input.operation,
-			walletId: input.walletId,
-			transportKind,
-			...timings
-		});
-	}
-	async registerWalletDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) try {
-			const walletRouterId = args.wallet.kind === "provided" ? String(args.wallet.walletId) : void 0;
-			const router = await this.walletIframe.requireRouter(walletRouterId);
-			this.emitWalletIframeTransportTimingSummary({
-				operation: "registerWallet",
-				walletId: walletRouterId ?? null
-			});
-			const res = await router.registerWallet(args);
-			const registeredWalletId = res.success ? String(res.walletId || "").trim() : "";
-			if (registeredWalletId) (async () => {
-				try {
-					await this.initWalletIframe(registeredWalletId);
-				} catch {}
-			})();
-			await args.options?.afterCall?.(true, res);
-			return res;
-		} catch (error) {
-			const e = toError(error);
-			await args.options?.onError?.(e);
-			await args.options?.afterCall?.(false);
-			throw e;
-		}
-		return await registerWallet({
-			context: this.getContext(),
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			options: args.options || {},
-			authenticatorOptions: cloneAuthenticatorOptions(this.configs.webauthn.authenticatorOptions)
-		});
-	}
-	async getNearProvisioningStateDomain(args) {
-		const walletId = toWalletId(args.walletId);
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter(String(walletId))).getNearProvisioningState({ walletId });
-		const live = readNearProvisioningState(walletId);
-		if (live) return live;
-		return await this.getContext().signingEngine.getWalletNearProvisioningState(walletId);
-	}
-	async resumePendingEcdsaRegistrationDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter(String(args.walletId))).resumePendingEcdsaRegistration(args);
-		const relayerUrl = String(this.configs.network.relayer?.url || "").trim();
-		if (!relayerUrl) throw new Error("pending ECDSA registration recovery requires a relayer URL");
-		return await resumePendingEcdsaRegistrationFromStoredCommit({
-			relayerUrl,
-			request: args,
-			signingSurface: this.signingEngine
-		});
-	}
-	async registerWalletSignerDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) try {
-			const res = await (await this.walletIframe.requireRouter(String(args.walletId || ""))).addWalletSigner(args);
-			await args.options?.afterCall?.(true, res);
-			return res;
-		} catch (error) {
-			const e = toError(error);
-			await args.options?.onError?.(e);
-			await args.options?.afterCall?.(false);
-			throw e;
-		}
-		return await addWalletSigner({
-			context: this.getContext(),
-			walletId: args.walletId,
-			rpId: args.rpId,
-			signerSelection: args.signerSelection,
-			options: args.options || {}
-		});
-	}
-	async addPasskeyDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) try {
-			const result = await (await this.walletIframe.requireRouter(String(args.walletId || ""))).addPasskey(args);
-			await args.options?.afterCall?.(true, result);
-			return result;
-		} catch (error) {
-			const normalized = toError(error);
-			await args.options?.onError?.(normalized);
-			await args.options?.afterCall?.(false);
-			throw normalized;
-		}
-		return await addPasskeyWalletAuthMethod({
-			context: this.getContext(),
-			walletId: args.walletId,
-			rpId: args.rpId,
-			options: args.options
-		});
-	}
-	async revokeAuthMethodDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter(String(args.walletId || ""))).revokeAuthMethod(args);
-		return await revokeWalletAuthMethodOperation({
-			context: this.getContext(),
-			walletId: args.walletId,
-			walletAuthMethodId: args.walletAuthMethodId
-		});
-	}
-	async addEmailOtpDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) try {
-			const result = await (await this.walletIframe.requireRouter(String(args.walletId || ""))).addEmailOtp(args);
-			await args.options?.afterCall?.(true, result);
-			return result;
-		} catch (error) {
-			const normalized = toError(error);
-			await args.options?.onError?.(normalized);
-			await args.options?.afterCall?.(false);
-			throw normalized;
-		}
-		return await addEmailOtpWalletAuthMethod({
-			context: this.getContext(),
-			walletId: args.walletId,
-			emailAddress: args.emailAddress,
-			options: args.options
-		});
-	}
-	async registerPasskeyDomain(options = {}) {
-		if (typeof options === "string") throw new Error("[SeamsWeb] registration.registerPasskey no longer accepts a NEAR account id; call registration.registerPasskey(options) for implicit NEAR registration or registerWallet(...) with explicit sponsored accountProvisioning.");
-		const { wallet, nearAccountProvisioning, ...registrationOptions } = options || {};
-		const rpId = this.walletIframe.resolveRegistrationRpId(this.signingEngine.getRpId());
-		const provisioningPreference = nearAccountProvisioning ?? this.configs.registration.nearAccountProvisioning;
-		const resolvedWallet = wallet || (provisioningPreference.kind === "relayer_named_subaccount" ? {
-			kind: "provided",
-			walletId: createServerAllocatedWalletId()
-		} : { kind: "server_allocated" });
-		const accountProvisioning = resolvePasskeyRegistrationAccountProvisioning({
-			configs: this.configs,
-			wallet: resolvedWallet,
-			preference: provisioningPreference
-		});
-		return await this.registerWalletDomain({
-			wallet: resolvedWallet,
-			authMethod: {
-				kind: "passkey",
-				rpId
-			},
-			signerSelection: buildNearWalletRegistrationSignerSetSelection({
-				configs: this.configs,
-				accountProvisioning,
-				options: registrationOptions
-			}),
-			options: registrationOptions
-		});
-	}
-	emailOtpRegistrationFlowId(walletId, challengeId) {
-		return `email-otp-registration:${String(walletId || "unknown-wallet").trim() || "unknown-wallet"}:${String(challengeId || "active").trim() || "active"}`;
-	}
-	emailOtpUnlockFlowId(walletId, challengeId) {
-		return `email-otp-unlock:${String(walletId || "unknown-wallet").trim() || "unknown-wallet"}:${String(challengeId || "active").trim() || "active"}`;
-	}
-	emitEmailOtpRegistrationEvent(onEvent, input) {
-		try {
-			onEvent?.(createRegistrationFlowEvent(input));
-		} catch {}
-	}
-	emitEmailOtpUnlockEvent(onEvent, input) {
-		try {
-			onEvent?.(createUnlockFlowEvent(input));
-		} catch {}
-	}
-	emitEmailOtpRegistrationFailure(onEvent, input) {
-		this.emitEmailOtpRegistrationEvent(onEvent, {
-			...input,
-			phase: RegistrationEventPhase.FAILED,
-			status: "failed",
-			error: { message: input.error.message }
-		});
-	}
-	emitEmailOtpUnlockWorkerProgress(onEvent, args) {
-		const chainLabel = args.chainTarget.kind === "tempo" ? "Tempo" : "EVM";
-		const base = {
-			flowId: args.flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		};
-		switch (args.progress.code) {
-			case "otp.verify.succeeded":
-				this.emitEmailOtpUnlockEvent(onEvent, {
-					...base,
-					phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					}
-				});
-				return UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED;
-			case "signer.ecdsa.bootstrap.started":
-				this.emitEmailOtpUnlockEvent(onEvent, {
-					...base,
-					phase: UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED,
-					status: "running",
-					message: `Preparing ${chainLabel} signing session`,
-					data: { chainTarget: args.chainTarget }
-				});
-				return UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED;
-			case "signer.ecdsa.bootstrap.prepared":
-				this.emitEmailOtpUnlockEvent(onEvent, {
-					...base,
-					phase: UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED,
-					status: "running",
-					message: `Coordinating ${chainLabel} signing session`,
-					data: { chainTarget: args.chainTarget }
-				});
-				return UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED;
-			case "signer.ecdsa.bootstrap.responded":
-				this.emitEmailOtpUnlockEvent(onEvent, {
-					...base,
-					phase: UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED,
-					status: "running",
-					message: `Finalizing ${chainLabel} signing session`,
-					data: { chainTarget: args.chainTarget }
-				});
-				return UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED;
-			case "signer.ecdsa.bootstrap.succeeded":
-				this.emitEmailOtpUnlockEvent(onEvent, {
-					...base,
-					phase: UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED,
-					status: "running",
-					message: `Saving ${chainLabel} signing session`,
-					data: { chainTarget: args.chainTarget }
-				});
-				return UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED;
-			default: return null;
-		}
-	}
-	emitEmailOtpUnlockFailure(onEvent, input) {
-		const cancelled = isUserCancellationError(input.error);
-		this.emitEmailOtpUnlockEvent(onEvent, {
-			...input,
-			phase: cancelled ? UnlockEventPhase.CANCELLED : UnlockEventPhase.FAILED,
-			status: cancelled ? "cancelled" : "failed",
-			interaction: input.interaction ?? {
-				kind: cancelled ? "otp_input" : "none",
-				overlay: "hide"
-			},
-			error: { message: input.error.message }
-		});
-	}
-	async requestEmailOtpChallengeDomain(args) {
-		const flowId = this.emailOtpUnlockFlowId(args.walletId);
-		this.emitEmailOtpUnlockEvent(args.onEvent, {
-			flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_STARTED,
-			status: "running"
-		});
-		try {
-			if (this.walletIframe.shouldUseWalletIframe()) {
-				const result = await (await this.walletIframe.requireRouter(args.walletId)).requestEmailOtpChallenge(args);
-				this.emitEmailOtpUnlockEvent(args.onEvent, {
-					flowId: this.emailOtpUnlockFlowId(args.walletId, result.challengeId),
-					walletId: args.walletId,
-					authMethod: "email_otp",
-					phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_SENT,
-					status: "succeeded",
-					data: {
-						challengeId: result.challengeId,
-						otpChannel: result.otpChannel
-					}
-				});
-				return result;
-			}
-			let walletAuthMethodId = args.walletAuthMethodId;
-			if (!walletAuthMethodId) {
-				const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId || "").trim());
-				if (selected.kind === "resolved" && selected.authMethod.kind === "email_otp" && selected.authMethod.status === "active" && String(selected.authMethod.walletId) === String(args.walletId || "").trim()) walletAuthMethodId = String(selected.authMethod.walletAuthMethodId);
-			}
-			if (!walletAuthMethodId) throw new Error("Email OTP challenge requires an exact walletAuthMethodId");
-			const result = await requestEmailOtpChallenge({
-				relayUrl: String(args.relayUrl || this.configs.network.relayer.url || "").trim(),
-				walletId: String(args.walletId || "").trim(),
-				walletAuthMethodId,
-				...args.operation ? { operation: args.operation } : {},
-				...args.operationFingerprintDigest ? { operationFingerprintDigest: args.operationFingerprintDigest } : {}
-			});
-			this.emitEmailOtpUnlockEvent(args.onEvent, {
-				flowId: this.emailOtpUnlockFlowId(args.walletId, result.challengeId),
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_SENT,
-				status: "succeeded",
-				data: {
-					challengeId: result.challengeId,
-					otpChannel: result.otpChannel
-				}
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			this.emitEmailOtpUnlockFailure(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				error: e
-			});
-			throw e;
-		}
-	}
-	async requestEmailOtpEnrollmentChallengeDomain(args) {
-		const flowId = this.emailOtpRegistrationFlowId(args.walletId);
-		this.emitEmailOtpRegistrationEvent(args.onEvent, {
-			flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_04_OTP_CHALLENGE_STARTED,
-			status: "running"
-		});
-		try {
-			if (this.walletIframe.shouldUseWalletIframe()) {
-				const result = await (await this.walletIframe.requireRouter(args.walletId)).requestEmailOtpEnrollmentChallenge(args);
-				this.emitEmailOtpRegistrationEvent(args.onEvent, {
-					flowId: this.emailOtpRegistrationFlowId(args.walletId, result.challengeId),
-					walletId: args.walletId,
-					authMethod: "email_otp",
-					phase: RegistrationEventPhase.STEP_04_OTP_CHALLENGE_SENT,
-					status: "succeeded",
-					data: {
-						challengeId: result.challengeId,
-						otpChannel: result.otpChannel
-					}
-				});
-				return result;
-			}
-			const result = await requestEmailOtpEnrollmentChallenge({
-				relayUrl: String(args.relayUrl || this.configs.network.relayer.url || "").trim(),
-				walletId: String(args.walletId || "").trim()
-			});
-			this.emitEmailOtpRegistrationEvent(args.onEvent, {
-				flowId: this.emailOtpRegistrationFlowId(args.walletId, result.challengeId),
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				phase: RegistrationEventPhase.STEP_04_OTP_CHALLENGE_SENT,
-				status: "succeeded",
-				data: {
-					challengeId: result.challengeId,
-					otpChannel: result.otpChannel
-				}
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			this.emitEmailOtpRegistrationFailure(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				error: e
-			});
-			throw e;
-		}
-	}
-	async requestEmailOtpSigningSessionChallengeDomain(args) {
-		const walletId = args.walletSession.walletId;
-		const flowId = this.emailOtpUnlockFlowId(walletId);
-		this.emitEmailOtpUnlockEvent(args.onEvent, {
-			flowId,
-			walletId,
-			authMethod: "email_otp",
-			phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_STARTED,
-			status: "running"
-		});
-		try {
-			if (this.walletIframe.shouldUseWalletIframe()) {
-				const result = await (await this.walletIframe.requireRouter(walletId)).requestEmailOtpSigningSessionChallenge({
-					walletSession: args.walletSession,
-					chainTarget: args.chainTarget
-				});
-				this.emitEmailOtpUnlockEvent(args.onEvent, {
-					flowId: this.emailOtpUnlockFlowId(walletId, result.challengeId),
-					walletId,
-					authMethod: "email_otp",
-					phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_SENT,
-					status: "succeeded",
-					data: {
-						challengeId: result.challengeId,
-						otpChannel: "email_otp"
-					}
-				});
-				return result;
-			}
-			const result = await this.signingEngine.requestEmailOtpSigningSessionChallenge({
-				walletSession: args.walletSession,
-				chainTarget: args.chainTarget
-			});
-			this.emitEmailOtpUnlockEvent(args.onEvent, {
-				flowId: this.emailOtpUnlockFlowId(walletId, result.challengeId),
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_03_EMAIL_OTP_CHALLENGE_SENT,
-				status: "succeeded",
-				data: {
-					challengeId: result.challengeId,
-					otpChannel: "email_otp"
-				}
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			this.emitEmailOtpUnlockFailure(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				error: e
-			});
-			throw e;
-		}
-	}
-	async enrollEmailOtpDomain(args) {
-		const flowId = this.emailOtpRegistrationFlowId(args.walletId, args.challengeId);
-		this.emitEmailOtpRegistrationEvent(args.onEvent, {
-			flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_STARTED,
-			status: "running",
-			interaction: {
-				kind: "otp_input",
-				overlay: "none"
-			},
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		});
-		try {
-			if (this.walletIframe.shouldUseWalletIframe()) {
-				if (args.clientSecret32) throw new Error("[SeamsWeb] Wallet iframe Email OTP enrollment owns client secret generation; clientSecret32 is not accepted from the app origin.");
-				const router = await this.walletIframe.requireRouter(args.walletId);
-				const iframeArgs = { ...args };
-				delete iframeArgs.clientSecret32;
-				delete iframeArgs.onEvent;
-				const result = await router.enrollEmailOtp(iframeArgs);
-				this.emitEmailOtpRegistrationEvent(args.onEvent, {
-					flowId,
-					walletId: args.walletId,
-					authMethod: "email_otp",
-					phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					},
-					...args.challengeId ? { requestId: args.challengeId } : {},
-					data: {
-						otpChannel: result.otpChannel,
-						enrollmentSealKeyVersion: result.enrollmentSealKeyVersion
-					}
-				});
-				this.emitEmailOtpRegistrationEvent(args.onEvent, {
-					flowId,
-					walletId: args.walletId,
-					authMethod: "email_otp",
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-					status: "running",
-					...args.challengeId ? { requestId: args.challengeId } : {}
-				});
-				this.emitEmailOtpRegistrationEvent(args.onEvent, {
-					flowId,
-					walletId: args.walletId,
-					authMethod: "email_otp",
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-					status: "succeeded",
-					...args.challengeId ? { requestId: args.challengeId } : {},
-					data: { unlockKeyVersion: result.unlockKeyVersion }
-				});
-				return result;
-			}
-			const result = await this.signingEngine.enrollEmailOtpInternal({
-				walletId: toWalletId(args.walletId),
-				otpCode: args.otpCode,
-				...args.relayUrl ? { relayUrl: args.relayUrl } : {},
-				challengeId: args.challengeId,
-				...args.groupId ? { groupId: args.groupId } : {},
-				...args.clientSecret32 ? { clientSecret32: args.clientSecret32 } : {}
-			});
-			this.emitEmailOtpRegistrationEvent(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-				status: "succeeded",
-				interaction: {
-					kind: "otp_input",
-					overlay: "hide"
-				},
-				...args.challengeId ? { requestId: args.challengeId } : {},
-				data: {
-					otpChannel: result.otpChannel,
-					enrollmentSealKeyVersion: result.enrollmentSealKeyVersion
-				}
-			});
-			this.emitEmailOtpRegistrationEvent(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-				status: "running",
-				...args.challengeId ? { requestId: args.challengeId } : {}
-			});
-			this.emitEmailOtpRegistrationEvent(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-				status: "succeeded",
-				...args.challengeId ? { requestId: args.challengeId } : {},
-				data: { unlockKeyVersion: result.unlockKeyVersion }
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			this.emitEmailOtpRegistrationFailure(args.onEvent, {
-				flowId,
-				walletId: args.walletId,
-				authMethod: "email_otp",
-				...args.challengeId ? { requestId: args.challengeId } : {},
-				error: e
-			});
-			throw e;
-		}
-	}
-	async getWalletRecoveryCodeStatusDomain(args) {
-		const relayUrl = String(this.configs.network.relayer.url || "").trim();
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter(args.walletId)).getWalletRecoveryCodeStatus({ walletId: args.walletId });
-		const status = await readWalletRecoveryCodeStatus({
-			relayUrl,
-			walletId: args.walletId
-		});
-		return status.kind === "ready" ? {
-			...status,
-			pendingLocalBackup: await pendingWalletRecoveryCodeBackupRepository.has(args.walletId)
-		} : status;
-	}
-	async beginGoogleEmailOtpWalletAuthDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter()).beginGoogleEmailOtpWalletAuth(args);
-		return await beginGoogleEmailOtpWalletAuth({
-			configs: this.configs,
-			resolveGoogleEmailOtpProvider: this.resolveGoogleEmailOtpProviderDomain.bind(this),
-			requestEmailOtpChallenge: this.requestEmailOtpChallengeDomain.bind(this),
-			prewarmEmailOtpYao: this.prewarmEmailOtpYaoDomain.bind(this),
-			registerWallet: this.registerWalletDomain.bind(this),
-			loginWithEmailOtpEcdsaCapability: this.loginWithEmailOtpEcdsaCapabilityDomain.bind(this),
-			loginWithEmailOtpEd25519YaoCapability: this.loginWithEmailOtpEd25519YaoCapabilityDomain.bind(this),
-			resolveLinkedEmailOtpWalletAuth: this.resolveLinkedEmailOtpWalletAuthDomain.bind(this),
-			loginWithLinkedEmailOtpWallet: this.loginWithLinkedEmailOtpWalletDomain.bind(this),
-			getWalletSession: this.getGoogleEmailOtpWalletSessionDomain.bind(this)
-		}, args);
-	}
-	async resolveGoogleEmailOtpProviderDomain(args) {
-		return await resolveGoogleEmailOtpProvider({
-			relayUrl: String(args.relayUrl || this.configs.network.relayer.url || "").trim(),
-			idToken: args.idToken,
-			accountMode: args.accountMode,
-			...args.loginWalletId ? { loginWalletId: args.loginWalletId } : {},
-			projectEnvironmentId: this.configs.registration.projectEnvironmentId,
-			publishableKey: this.configs.registration.publishableKey,
-			...args.restartRegistrationOffer === true ? { restartRegistrationOffer: true } : {}
-		});
-	}
-	async resolveLinkedEmailOtpWalletAuthDomain(args) {
-		const emailHashHex = await this.emailOtpEmailHashHex(args.email);
-		const resolution = await resolveLinkedDeviceEmailOtpAuthoritySelection({
-			walletIdInput: args.walletId,
-			emailHashHex,
-			provider: args.provider,
-			providerSubjectId: args.providerSubjectId
-		});
-		switch (resolution.kind) {
-			case "none": {
-				const foundingMethods = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(args.walletId)).filter((method) => method.kind === "email_otp" && method.status === "active" && method.emailHashHex.toLowerCase() === emailHashHex);
-				const foundingMethod = foundingMethods[0];
-				if (foundingMethods.length === 0 || !foundingMethod) {
-					const exactLocalFactors = (await IndexedDBManager.listWalletAuthMethodsForWallet(args.walletId)).filter((method) => method.kind === "email_otp" && method.status === "active" && method.emailHashHex.toLowerCase() === emailHashHex && isEmailOtpWalletAuthAuthority(method.authority) && method.authority.factor.provider === "google" && method.authority.factor.providerUserId === args.providerSubjectId);
-					const exactLocalFactor = exactLocalFactors[0];
-					if (exactLocalFactors.length === 0 || !exactLocalFactor) return { kind: "none" };
-					if (exactLocalFactors.length !== 1) return {
-						kind: "rejected",
-						message: "Multiple active local Email OTP factors match the verified email"
-					};
-					const exactAuthority = exactLocalFactor.authority;
-					if (!exactAuthority || !isEmailOtpWalletAuthAuthority(exactAuthority)) return { kind: "none" };
-					return {
-						kind: "selected",
-						walletAuthMethodId: String(exactAuthority.bindingId),
-						execution: "ordinary"
-					};
-				}
-				if (foundingMethods.length !== 1) return {
-					kind: "rejected",
-					message: "Multiple active local Email OTP authorities match the verified email"
-				};
-				const authority = await IndexedDBManager.getWalletAuthority(String(foundingMethod.walletAuthorityId));
-				if (!authority || authority.state !== "active" || authority.walletId !== foundingMethod.walletId || authority.authorityId !== foundingMethod.walletAuthorityId || authority.provenance.kind !== "wallet_registration" && authority.provenance.kind !== "wallet_recovery") return { kind: "none" };
-				await resolveExactLinkedEmailOtpAuthority({
-					authMethod: foundingMethod,
-					provider: "google",
-					providerSubjectId: args.providerSubjectId
-				});
-				return {
-					kind: "selected",
-					walletAuthMethodId: String(foundingMethod.walletAuthMethodId),
-					execution: await googleEmailOtpUnlockExecution(authority.provenance, foundingMethod.walletAuthMethodId),
-					keyFamilies: authority.signerActivations.keyFamilies
-				};
-			}
-			case "selected": return {
-				kind: "selected",
-				walletAuthMethodId: String(resolution.selection.authMethod.walletAuthMethodId),
-				execution: await googleEmailOtpUnlockExecution(resolution.selection.authority.provenance, resolution.selection.authMethod.walletAuthMethodId),
-				keyFamilies: resolution.selection.authority.signerActivations.keyFamilies
-			};
-			case "rejected": return {
-				kind: "rejected",
-				message: resolution.message
-			};
-			default: throw new Error("Linked Email OTP authority resolution is invalid");
-		}
-	}
-	async loginWithLinkedEmailOtpWalletDomain(args) {
-		if (this.walletIframe.shouldUseWalletIframe()) {
-			await (await this.walletIframe.requireRouter(String(args.walletId || ""))).unlockAddedEmailOtpWallet({
-				walletId: args.walletId,
-				walletAuthMethodId: args.walletAuthMethodId,
-				email: args.email,
-				providerSubjectId: args.providerSubjectId,
-				challengeId: args.challengeId,
-				otpCode: args.otpCode,
-				relayUrl: args.relayUrl
-			});
-			this.resumePendingAcknowledgementsAfterExactUnlockV1();
-			return;
-		}
-		const emailHashHex = await this.emailOtpEmailHashHex(args.email);
-		await unlockLinkedDeviceEmailOtpWallet({
-			context: this.getContext(),
-			walletIdInput: args.walletId,
-			emailHashHex,
-			walletAuthMethodId: args.walletAuthMethodId,
-			providerSubjectId: args.providerSubjectId,
-			challengeId: args.challengeId,
-			otpCode: args.otpCode,
-			relayUrl: args.relayUrl
-		});
-		this.resumePendingAcknowledgementsAfterExactUnlockV1();
-	}
-	async prewarmEmailOtpYaoDomain() {
-		await this.signingEngine.prewarmEmailOtpYao();
-	}
-	async getGoogleEmailOtpWalletSessionDomain(walletId) {
-		return await getWalletSessionDomain(this.getWalletAuthDeps(), walletId);
-	}
-	async acknowledgeWalletRecoveryCodeBackupDomain(args) {
-		const relayUrl = String(this.configs.network.relayer.url || "").trim();
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireTransportRouter()).acknowledgeWalletRecoveryCodeBackup({ walletId: args.walletId });
-		if ((await showWalletRecoveryCodesUi({
-			walletId: args.walletId,
-			loadStatus: this.getWalletRecoveryCodeStatusDomain.bind(this, args),
-			loadPendingBackup: this.loadPendingWalletRecoveryCodeBackupRequest.bind(this, args.walletId)
-		}, this.signingEngine.getWalletIframeSurfaceMeasurementBinding(), { appearance: this.appearance })).kind !== "wallet_recovery_codes_backed_up_v1") throw new Error("Pending wallet recovery-code backup was not completed");
-		const result = await acknowledgeWalletRecoveryBackup({
-			relayUrl,
-			walletId: args.walletId
-		});
-		if (result.kind === "acknowledged") await pendingWalletRecoveryCodeBackupRepository.delete(args.walletId);
-		return result;
-	}
-	async loadPendingWalletRecoveryCodeBackupRequest(walletId) {
-		const pending = await pendingWalletRecoveryCodeBackupRepository.read(walletId);
-		return pending ? {
-			kind: "wallet_recovery_code_backup_request_v1",
-			walletId: pending.walletId,
-			recoveryCodes: pending.recoveryCodes,
-			continuation: "pending_backup_must_finish"
-		} : null;
-	}
-	async requestWalletCustodyEmailOtpChallengeDomain(args) {
-		return await requestWalletCustodyEmailOtpChallenge({
-			relayUrl: String(this.configs.network.relayer.url || "").trim(),
-			...args
-		});
-	}
-	async rotateWalletRecoveryCodesDomain(args) {
-		const relayUrl = String(this.configs.network.relayer.url || "").trim();
-		if (this.walletIframe.shouldUseWalletIframe()) return await (await this.walletIframe.requireRouter(args.walletId)).rotateWalletRecoveryCodes(args);
-		return await rotateWalletRecoveryCodes({
-			context: this.getContext(),
-			relayUrl,
-			walletId: args.walletId,
-			authorization: args.authorization
-		});
-	}
-	async loginWithEmailOtpEd25519YaoCapabilityDomain(args) {
-		if (args.authoritySelector.kind !== "wallet_auth_method") throw new Error("Email OTP Ed25519 unlock requires an exact wallet auth method");
-		const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail);
-		const signer = await this.signingEngine.loginWithEmailOtpWalletCustodyEd25519Internal({
-			...args,
-			emailHashHex
-		});
-		await activateEmailOtpWalletAfterUnlock({
-			signingEngine: this.signingEngine,
-			nearClient: this.nearClient
-		}, {
-			kind: "near_ed25519_wallet",
-			signer,
-			walletAuthMethodId: requireWalletAuthMethodId(args.authoritySelector.walletAuthMethodId)
-		});
-	}
-	async emailOtpEmailHashHex(email) {
-		const normalizedEmail = String(email || "").trim().toLowerCase();
-		if (!normalizedEmail) throw new Error("[SeamsWeb][email-otp] verified email is required for auth-method hash");
-		return sha256HexUtf8(normalizedEmail);
-	}
-	async loginWithEmailOtpEcdsaCapabilityDomain(args) {
-		const walletId = args.walletSession.walletId;
-		const flowId = this.emailOtpUnlockFlowId(walletId, args.challengeId);
-		const chainTarget = requireConcreteEcdsaChainTarget(args.chainTarget, "Email OTP ECDSA unlock");
-		const unlockTiming = {
-			startedAtMs: nowMs(),
-			timings: createEmailOtpUnlockTimings()
-		};
-		const prewarm = emailOtpUnlockPrewarmSnapshot({
-			record: this.emailOtpUnlockPrewarmRecord,
-			walletId,
-			nowMs: Date.now()
-		});
-		this.emitEmailOtpUnlockEvent(args.onEvent, {
-			flowId,
-			walletId,
-			authMethod: "email_otp",
-			phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_STARTED,
-			status: "running",
-			interaction: {
-				kind: "otp_input",
-				overlay: "none"
-			},
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		});
-		try {
-			if (this.walletIframe.shouldUseWalletIframe()) {
-				const router = await this.walletIframe.requireRouter(walletId);
-				const iframeArgs = {
-					...args,
-					chainTarget
-				};
-				delete iframeArgs.onEvent;
-				const iframeStartedAtMs = nowMs();
-				const result = await router.loginWithEmailOtpEcdsaCapability(iframeArgs);
-				const walletIframeRoundTripMs = nowMs() - iframeStartedAtMs;
-				recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "walletIframeRoundTripMs", walletIframeRoundTripMs);
-				logEmailOtpUnlockTimingSummary({
-					status: "succeeded",
-					mode: "evm_family_ecdsa",
-					walletId,
-					prewarm,
-					chainTarget,
-					startedAtMs: unlockTiming.startedAtMs,
-					timings: unlockTiming.timings
-				});
-				this.emitEmailOtpUnlockEvent(args.onEvent, {
-					flowId,
-					walletId,
-					authMethod: "email_otp",
-					phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					},
-					...args.challengeId ? { requestId: args.challengeId } : {}
-				});
-				this.emitEmailOtpUnlockEvent(args.onEvent, {
-					flowId,
-					walletId,
-					authMethod: "email_otp",
-					phase: UnlockEventPhase.STEP_05_ECDSA_SIGNING_SESSION_READY,
-					status: "succeeded",
-					...args.challengeId ? { requestId: args.challengeId } : {},
-					data: { chainTarget }
-				});
-				this.emitEmailOtpUnlockEvent(args.onEvent, {
-					flowId,
-					walletId,
-					authMethod: "email_otp",
-					phase: UnlockEventPhase.STEP_07_COMPLETED,
-					status: "succeeded",
-					...args.challengeId ? { requestId: args.challengeId } : {}
-				});
-				return result;
-			}
-			const workerProgressPhases = /* @__PURE__ */ new Set();
-			const markWorkerProgress = (progress) => {
-				const phase = this.emitEmailOtpUnlockWorkerProgress(args.onEvent, {
-					flowId,
-					walletId,
-					challengeId: args.challengeId,
-					chainTarget,
-					progress
-				});
-				if (phase) workerProgressPhases.add(phase);
-			};
-			const emitIfWorkerProgressMissing = (input) => {
-				if (workerProgressPhases.has(input.phase)) return;
-				this.emitEmailOtpUnlockEvent(args.onEvent, input);
-			};
-			let timingStartedAtMs = nowMs();
-			const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail || "");
-			recordEmailOtpUnlockTiming(unlockTiming.timings, "emailHashLookupMs", timingStartedAtMs);
-			timingStartedAtMs = nowMs();
-			const ed25519Selection = args.ed25519Selection.kind === "present" ? args.ed25519Selection : null;
-			const result = await this.signingEngine.loginWithEmailOtpEcdsaCapabilityInternal({
-				...args,
-				authoritySelector: {
-					kind: "wallet_auth_method",
-					walletAuthMethodId: args.walletAuthMethodId
-				},
-				chainTarget,
-				emailHashHex,
-				...ed25519Selection ? { ed25519YaoRecovery: {
-					kind: "requested",
-					providerSubject: args.providerIdentity.providerSubjectId,
-					signerSlot: ed25519Selection.signerSlot,
-					nearAccountId: ed25519Selection.nearAccountId,
-					expectedOperationalPublicKey: ed25519Selection.operationalPublicKey,
-					expectedThresholdSessionId: ed25519Selection.thresholdSessionId
-				} } : { ed25519YaoRecovery: { kind: "not_requested" } },
-				ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-				providerIdentity: {
-					kind: "explicit_provider_user",
-					provider: args.providerIdentity.provider,
-					providerUserId: args.providerIdentity.providerSubjectId
-				},
-				onProgress: markWorkerProgress
-			});
-			await persistVerifiedEmailOtpAuthorityAfterUnlock({
-				walletId: String(walletId),
-				walletAuthMethodId: String(args.walletAuthMethodId),
-				projection: result.recovery.verifiedAuthorityProjection
-			});
-			let walletActivation;
-			if (ed25519Selection) {
-				let recoveredEd25519Signer;
-				switch (result.ed25519YaoRecovery.kind) {
-					case "capability":
-						recoveredEd25519Signer = await this.signingEngine.activateEmailOtpEd25519CustodyCapabilityInternal({
-							walletSession: args.walletSession,
-							providerSubject: args.providerIdentity.providerSubjectId,
-							emailHashHex,
-							signerSlot: ed25519Selection.signerSlot,
-							expectedOperationalPublicKey: ed25519Selection.operationalPublicKey,
-							expectedThresholdSessionId: ed25519Selection.thresholdSessionId,
-							bootstrap: result.ed25519YaoRecovery.bootstrap,
-							activeClientHandle: result.ed25519YaoRecovery.activeClientHandle,
-							metadata: result.ed25519YaoRecovery.metadata,
-							authority: exactEmailOtpAuthorityRefFromLoginResult(result)
-						});
-						break;
-					case "cache_absent": throw new Error("Email OTP wallet custody material is unavailable; recover with a recovery code");
-					case "not_requested": throw new Error("Email OTP capability unlock omitted Ed25519 Yao session material");
-					default: throw new Error("Email OTP capability unlock returned an invalid Ed25519 Yao state");
-				}
-				walletActivation = {
-					kind: "near_ed25519_wallet",
-					signer: recoveredEd25519Signer,
-					walletAuthMethodId: requireWalletAuthMethodId(args.walletAuthMethodId)
-				};
-			} else {
-				if (result.ed25519YaoRecovery.kind !== "not_requested") throw new Error("EVM-family ECDSA Email OTP unlock returned unexpected Ed25519 Yao material");
-				walletActivation = {
-					kind: "evm_family_ecdsa_wallet",
-					walletId,
-					walletAuthMethodId: requireWalletAuthMethodId(args.walletAuthMethodId)
-				};
-			}
-			const workerUnlockMs = nowMs() - timingStartedAtMs;
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "workerUnlockAndSessionBootstrapMs", workerUnlockMs);
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "emailOtpProofVerificationMs", result.timings.emailOtpProofVerificationMs);
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "ecdsaMaterialRestoreMs", result.timings.ecdsaMaterialRestoreMs);
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "signingSessionSealApplyMs", result.timings.signingSessionSealApplyMs);
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "warmCapabilityPersistenceMs", result.timings.warmCapabilityPersistenceMs);
-			timingStartedAtMs = nowMs();
-			await activateEmailOtpWalletAfterUnlock({
-				signingEngine: this.signingEngine,
-				nearClient: this.nearClient
-			}, walletActivation);
-			recordEmailOtpUnlockTiming(unlockTiming.timings, "walletStateActivationMs", timingStartedAtMs);
-			timingStartedAtMs = nowMs();
-			const ownerAuthority = await walletAuthAuthorityRefForVerifiedEmailOtpUnlock({
-				walletId: String(walletId),
-				walletAuthMethodId: String(args.walletAuthMethodId),
-				providerSubject: args.providerIdentity.providerSubjectId,
-				emailHashHex,
-				projection: result.recovery.verifiedAuthorityProjection
-			});
-			const runtimeInventory = await assertWalletRuntimePostconditions({
-				source: "wallet_unlock",
-				walletId,
-				ownerScope: {
-					auth: {
-						kind: "email_otp",
-						providerSubjectId: args.providerIdentity.providerSubjectId
-					},
-					ownerAuthority: {
-						walletAuthMethodId: ownerAuthority.walletAuthMethodId,
-						authorityDigest: ownerAuthority.authorityDigest
-					}
-				},
-				requiredTargets: [...ed25519Selection ? [{ curve: "ed25519" }] : [], ...(args.publicationChainTargets ?? [chainTarget]).map((target) => ({
-					curve: "ecdsa",
-					chainTarget: target
-				}))],
-				readOwnerScopedSigningLanes: async (input) => await this.signingEngine.readOwnerScopedSigningLanes(input, new WalletSessionStatusReadScope())
-			});
-			logEmailOtpUnlockActivationPlan(buildEmailOtpEcdsaUnlockActivationPlan({
-				walletSession: args.walletSession,
-				result,
-				runtimeInventory
-			}));
-			const activeRuntimeConstructionMs = nowMs() - timingStartedAtMs;
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "runtimePostconditionMs", activeRuntimeConstructionMs);
-			recordEmailOtpUnlockElapsedTiming(unlockTiming.timings, "activeRuntimeConstructionMs", activeRuntimeConstructionMs);
-			logEmailOtpUnlockTimingSummary({
-				status: "succeeded",
-				mode: "evm_family_ecdsa",
-				walletId,
-				prewarm,
-				chainTarget,
-				startedAtMs: unlockTiming.startedAtMs,
-				timings: unlockTiming.timings
-			});
-			emitIfWorkerProgressMissing({
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,
-				status: "succeeded",
-				interaction: {
-					kind: "otp_input",
-					overlay: "hide"
-				},
-				...args.challengeId ? { requestId: args.challengeId } : {}
-			});
-			emitIfWorkerProgressMissing({
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_05_ECDSA_SIGNING_SESSION_READY,
-				status: "succeeded",
-				...args.challengeId ? { requestId: args.challengeId } : {},
-				data: { chainTarget }
-			});
-			emitIfWorkerProgressMissing({
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_07_COMPLETED,
-				status: "succeeded",
-				...args.challengeId ? { requestId: args.challengeId } : {}
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			logEmailOtpUnlockTimingSummary({
-				status: "failed",
-				mode: "evm_family_ecdsa",
-				walletId,
-				prewarm,
-				chainTarget,
-				startedAtMs: unlockTiming.startedAtMs,
-				timings: unlockTiming.timings,
-				error: e
-			});
-			this.emitEmailOtpUnlockFailure(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				...args.challengeId ? { requestId: args.challengeId } : {},
-				error: e
-			});
-			throw e;
-		}
-	}
-	async refreshEmailOtpSigningSessionDomain(args) {
-		const walletId = args.walletSession.walletId;
-		const flowId = this.emailOtpUnlockFlowId(walletId, args.challengeId);
-		const chainTarget = requireConcreteEcdsaChainTarget(args.chainTarget, "Email OTP signing-session refresh");
-		this.emitEmailOtpUnlockEvent(args.onEvent, {
-			flowId,
-			walletId,
-			authMethod: "email_otp",
-			phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_STARTED,
-			status: "running",
-			interaction: {
-				kind: "otp_input",
-				overlay: "none"
-			},
-			requestId: args.challengeId
-		});
-		try {
-			const result = this.walletIframe.shouldUseWalletIframe() ? await (await this.walletIframe.requireRouter(walletId)).refreshEmailOtpSigningSession({
-				walletSession: args.walletSession,
-				chainTarget,
-				challengeId: args.challengeId,
-				otpCode: args.otpCode,
-				...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-				...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {}
-			}) : await this.signingEngine.refreshEmailOtpSigningSession({
-				walletSession: args.walletSession,
-				chainTarget,
-				challengeId: args.challengeId,
-				otpCode: args.otpCode,
-				...typeof args.ttlMs === "number" ? { ttlMs: args.ttlMs } : {},
-				...typeof args.remainingUses === "number" ? { remainingUses: args.remainingUses } : {}
-			});
-			this.emitEmailOtpUnlockEvent(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_03_EMAIL_OTP_VERIFY_SUCCEEDED,
-				status: "succeeded",
-				interaction: {
-					kind: "otp_input",
-					overlay: "hide"
-				},
-				requestId: args.challengeId
-			});
-			this.emitEmailOtpUnlockEvent(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_05_ECDSA_SIGNING_SESSION_READY,
-				status: "succeeded",
-				requestId: args.challengeId,
-				data: { chainTarget }
-			});
-			this.emitEmailOtpUnlockEvent(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				phase: UnlockEventPhase.STEP_07_COMPLETED,
-				status: "succeeded",
-				requestId: args.challengeId
-			});
-			return result;
-		} catch (error) {
-			const e = toError(error);
-			this.emitEmailOtpUnlockFailure(args.onEvent, {
-				flowId,
-				walletId,
-				authMethod: "email_otp",
-				requestId: args.challengeId,
-				error: e
-			});
-			throw e;
-		}
-	}
-	/**
-	* Prefetch latest block height/hash (and nonce if context missing) to reduce
-	* perceived latency when the user initiates a signing flow.
-	*/
-	async prefetchBlockheight() {
-		if (this.walletIframe.shouldUseWalletIframe()) {
-			await (await this.walletIframe.requireRouter()).prefetchBlockheight();
-			return;
-		}
-		try {
-			await this.signingEngine.getNonceCoordinator().prefetchNearContext({
-				kind: "initialized_state",
-				nearClient: this.nearClient
-			});
-		} catch {}
-	}
-	/** Wallet-host entrypoint for the exact FeeManager preference operation. */
-	async signTempoFeeTokenPreferenceInternal(args) {
-		if (!__isWalletIframeHostMode()) throw new Error("[SeamsWeb][tempo] fee-token preference signing requires wallet-host mode");
-		const request = requireTempoFeeTokenPreferenceSigningRequest(args);
-		const result = await this.signingEngine.signEvmFamily({
-			...args,
-			request
-		});
-		if (result.chain !== "evm" || result.kind !== "eip1559") throw new Error(`[SeamsWeb][tempo] expected EVM FeeManager result, received ${result.chain}`);
-		return result;
-	}
-	/**
-	* Canonical entrypoint to show secure key export UI (wallet-origin only) without
-	* returning private keys to the caller.
-	*/
-	async resolveExactKeyExportLaneDomain(input) {
-		const resolvedInput = normalizeResolveExactKeyExportLaneInput(input);
-		const routerAccountId = String(resolvedInput.walletSession.walletId || "").trim();
-		if (!routerAccountId) throw new Error("[SeamsWeb] key export lane resolution requires wallet session context");
-		if (this.walletIframe.shouldUseWalletIframe()) return normalizeResolveExactKeyExportLaneResult(await (await this.walletIframe.requireRouter(routerAccountId)).resolveExactKeyExportLane(resolvedInput));
-		return normalizeResolveExactKeyExportLaneResult(await this.signingEngine.resolveExactKeyExportLane(resolvedInput));
-	}
-	async exportKeypairWithUIDomain(input) {
-		const resolvedInput = normalizeExportKeypairWithUIInput(input, this.theme);
-		const routerAccountId = String(resolvedInput.walletSession.walletId || "").trim();
-		if (!routerAccountId) throw new Error("[SeamsWeb] key export requires wallet session user context");
-		if (this.walletIframe.shouldUseWalletIframe()) {
-			await (await this.walletIframe.requireRouter(routerAccountId)).exportKeypairWithUI(resolvedInput);
-			return;
-		}
-		await this.signingEngine.exportKeypairWithUI(resolvedInput);
-	}
-};
-//#endregion
-export { SeamsWeb };
-
-//# sourceMappingURL=SeamsWeb.js.map