@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/operations/auth/login.js

@@ -1,4383 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { joinNormalizedUrl } from "../../../shared-ts/src/utils/normalize.js";
-import { isObject } from "../../../shared-ts/src/utils/validation.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseWalletSessionOperationCredentialV1 } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
-import { SIGNER_AUTH_METHODS } from "../../../shared-ts/src/utils/signerDomain.js";
-import { UnlockEventPhase, createUnlockFlowEvent } from "../../../core/types/sdkSentEvents.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { buildEmailOtpWalletAuthMethodBinding, buildPasskeyAuthScope, buildPasskeyWalletAuthMethodBinding, buildWalletIdentity, parseRpId } from "../../../shared-ts/src/utils/walletCapabilityBindings.js";
-import { thresholdEcdsaChainTargetKey } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildBaseEvmFamilyEcdsaKeyIdentity, buildEvmFamilyEcdsaSessionLanePolicy, deriveEvmFamilySigningKeySlotId, evmFamilyEcdsaWalletKeyToIdentity, resolveThresholdSigningRootBindingFromRuntimePolicyScope, toEvmFamilyEcdsaKeyHandle, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { exactEd25519SigningLaneIdentity, nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
-import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { DEFAULT_UNLOCK_REMAINING_USES, resolveWalletUnlockSessionUsesFromRequestedUses } from "../../../core/signingEngine/threshold/sessionPolicy.js";
-import { parseSignerSlot } from "../../../shared-ts/src/utils/signerSlot.js";
-import { IndexedDbEd25519YaoPublicCapabilityReferenceStore, publishEd25519YaoPublicCapabilityReferenceAndLane } from "../../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
-import { isWalletCustodySeedBinding } from "../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, RouterAbEd25519YaoClientV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { buildPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { destroyLinkedDeviceEcdsaHolderMaterialWasm, reconcileCanonicalEcdsaActivationWasm, storeLinkedDeviceEcdsaHolderMaterialWasm } from "../../../core/signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbServerIdentityV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { openWalletAuthorityLinkedSignerMaterialV1 } from "../../../core/indexedDB/linkedAuthoritySignerMaterial.js";
-import { getUserFriendlyErrorMessage, isUserCancellationError, toError } from "../../../shared-ts/src/utils/errors.js";
-import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
-import { WalletSessionAuthorizationUpgradeRequiredError, walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { installLinkedEcdsaHolderRuntimeV1, removeLinkedEcdsaHolderRuntimeV1, resolveLinkedEcdsaHolderRuntimeV1 } from "../../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
-import { fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, fetchWalletEcdsaKeyFactsInventoryWithWebAuthn } from "../../../core/rpcClients/relayer/walletRegistration.js";
-import { ecdsaAvailableLaneForTarget, isConcreteAvailableSigningLane } from "../../../core/signingEngine/session/availability/availableSigningLanes.js";
-import { buildRouterAbEd25519SigningWalletSession } from "../../../core/signingEngine/session/routerAbSigningWalletSession.js";
-import { buildPasskeyRouterAbEd25519WalletSessionState } from "../../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
-import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
-import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { getNearThresholdKeyMaterial } from "../../../core/accountData/near/keyMaterial.js";
-import { isEcdsaCredentialFreeSessionActivationAuthorization } from "../../../core/signingEngine/threshold/ecdsa/postRegistrationSessionActivation.js";
-import { exactWalletSessionAuthorityIdentity } from "../../../core/signingEngine/session/persistence/walletSessionAuthorizationProjection.js";
-import { getNearAccountProjection } from "../../../core/accountData/near/accountProjection.js";
-import { readExactWalletSessionAuthentication } from "../../../core/signingEngine/session/identity/exactWalletSessionReader.js";
-import { destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, establishUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
-import { unlockEmailOtpAuthorityWallet } from "../../../core/signingEngine/session/emailOtp/walletUnlock.js";
-import { disposeWalletCustodyEd25519ActiveClientV1 } from "../../../core/signingEngine/walletCustody/ed25519ActiveClient.js";
-import { browserExactWalletSessionReadPorts } from "../../../core/signingEngine/assembly/ports/emailOtp.js";
-import { listBrowserCanonicalEcdsaSigningCapabilitiesForWallet, resolveBrowserActiveEcdsaCapabilityRuntime } from "../../assembly/browserSigningSurfaceAssembly.js";
-import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
-import { listConfiguredThresholdEcdsaPublicationTargets } from "../session/thresholdEcdsaProvisioning.js";
-import { openWalletCustodyEd25519ActiveClientV1, walletCustodyActivationFactsFromActiveClientMetadataV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
-import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
-import { verifyPasskeyWalletUnlock } from "../../../core/rpcClients/near/rpcCalls.js";
-import { passkeyCredentialIdB64uFromAuthentication, passkeyPrfFirstB64uFromCredential } from "../authMethods/passkey/ecdsaBootstrap.js";
-import { scheduleEcdsaSessionPresignaturePrefill } from "./scheduleEcdsaSessionPresignaturePrefill.js";
-import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
-import { exactPasskeyWalletAuthAuthorityRefForCredential, exactPasskeyWalletAuthMethodForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
-import { scheduleLinkedDevicePresignaturePrefill } from "./scheduleLinkedDevicePresignaturePrefill.js";
-import { createRouterAbNormalSigningPolicy } from "../session/thresholdWarmSessionBootstrap.js";
-import { assertWalletRuntimePostconditions } from "../../../core/signingEngine/session/postconditions/runtimePostconditions.js";
-import { buildConfiguredTargetKeyCompletion, collectConfiguredTargetThresholdEcdsaWarmKeys, configuredTargetThresholdEcdsaWarmKey, mergeCanonicalThresholdEcdsaWarmSessionContexts, parseActiveEcdsaSignerRecordForUnlock, planUnlockEcdsaWarmup, requireCompleteConfiguredTargetKeyContext } from "../../../core/signingEngine/session/passkey/unlockEcdsaWarmupPlanner.js";
-import { collectPasskeyLoginAssertion } from "../authMethods/passkey/loginAssertion.js";
-import { collectFreshLocalPasskeyUnlockCredential, createLocalUnlockChallengeB64u } from "../authMethods/passkey/localUnlock.js";
-import { resolveEcdsaActivationJournalSelectors } from "./walletUnlockEcdsaSubject.js";
-import { resolveWalletCapabilitySubjectResolution } from "./walletUnlockSubject.js";
-//#region src/SeamsWeb/operations/auth/login.ts
-function emitUnlockEvent(onEvent, unlockSubjectId, event) {
-	onEvent?.(createUnlockFlowEvent({
-		flowId: `unlock:${unlockSubjectId}`,
-		accountId: unlockSubjectId,
-		...event
-	}));
-}
-function resolveLoginWalletUnlockSelection(selection) {
-	switch (selection?.mode) {
-		case "ed25519_only": return {
-			mode: "ed25519_only",
-			ed25519: true
-		};
-		case "ecdsa_only": return {
-			mode: "ecdsa_only",
-			ecdsa: true
-		};
-		case "ed25519_and_ecdsa":
-		case void 0: return {
-			mode: "ed25519_and_ecdsa",
-			ed25519: true,
-			ecdsa: true
-		};
-	}
-	return assertNeverLoginState(selection);
-}
-function resolveLoginWalletUnlockSelectionForSubjectSet(args) {
-	if (args.selection) return resolveLoginWalletUnlockSelection(args.selection);
-	let hasNearEd25519 = false;
-	let hasEvmFamilyEcdsa = false;
-	for (const subject of args.subjectSet.subjects) switch (subject.kind) {
-		case "near_ed25519_wallet":
-			hasNearEd25519 = true;
-			break;
-		case "evm_family_ecdsa_wallet":
-			hasEvmFamilyEcdsa = true;
-			break;
-		default: return assertNeverLoginState(subject);
-	}
-	if (hasNearEd25519 && hasEvmFamilyEcdsa) return {
-		mode: "ed25519_and_ecdsa",
-		ed25519: true,
-		ecdsa: true
-	};
-	if (hasNearEd25519) return {
-		mode: "ed25519_only",
-		ed25519: true
-	};
-	if (hasEvmFamilyEcdsa) return {
-		mode: "ecdsa_only",
-		ecdsa: true
-	};
-	throw new Error("[login] wallet unlock subject set has no supported capability");
-}
-function buildAnonymousWalletSession() {
-	return {
-		appIdentity: { kind: "anonymous" },
-		authentication: { kind: "signed_out" },
-		capabilityProjection: { kind: "not_requested" },
-		nonceDiagnostics: null
-	};
-}
-function isNearEd25519WalletSubject(subject) {
-	return subject.kind === "near_ed25519_wallet";
-}
-function isEvmFamilyEcdsaWalletSubject(subject) {
-	return subject.kind === "evm_family_ecdsa_wallet";
-}
-function selectNearEd25519WalletSubject(subjectSet) {
-	const nearSubjects = subjectSet.subjects.filter(isNearEd25519WalletSubject);
-	if (nearSubjects.length === 0) return null;
-	if (nearSubjects.length > 1) throw new Error("[WalletSession] multiple NEAR Ed25519 subjects found for wallet session");
-	return nearSubjects[0] || null;
-}
-function resolveLoginWalletIdentity(args) {
-	const nearSubject = selectNearEd25519WalletSubject(args.subjectSet);
-	const ecdsaSubjects = args.subjectSet.subjects.filter(isEvmFamilyEcdsaWalletSubject);
-	for (const subject of args.subjectSet.subjects) if (String(subject.walletId) !== String(args.subjectSet.walletId)) throw new Error("[login] wallet unlock subject belongs to a different wallet");
-	switch (args.selection.mode) {
-		case "ed25519_only":
-			if (!nearSubject || ecdsaSubjects.length !== 0) throw new Error("[login] NEAR Ed25519 unlock requires one exact NEAR subject set");
-			return {
-				kind: "near_ed25519_capable_wallet",
-				walletId: args.subjectSet.walletId,
-				subjectSet: args.subjectSet,
-				nearAccountId: nearSubject.nearAccountId,
-				nearEd25519SigningKeyId: nearSubject.nearEd25519SigningKeyId,
-				signerSlot: nearSubject.signerSlot
-			};
-		case "ecdsa_only": {
-			const [firstEcdsaSubject, ...remainingEcdsaSubjects] = ecdsaSubjects;
-			if (nearSubject || !firstEcdsaSubject) throw new Error("[login] ECDSA-only unlock requires exact ECDSA subjects");
-			return {
-				kind: "evm_family_ecdsa_only_wallet",
-				walletId: args.subjectSet.walletId,
-				subjectSet: args.subjectSet,
-				ecdsaSubjects: [firstEcdsaSubject, ...remainingEcdsaSubjects]
-			};
-		}
-		case "ed25519_and_ecdsa":
-			if (!nearSubject || ecdsaSubjects.length === 0) throw new Error("[login] combined unlock requires exact NEAR and ECDSA subjects");
-			return {
-				kind: "near_ed25519_capable_wallet",
-				walletId: args.subjectSet.walletId,
-				subjectSet: args.subjectSet,
-				nearAccountId: nearSubject.nearAccountId,
-				nearEd25519SigningKeyId: nearSubject.nearEd25519SigningKeyId,
-				signerSlot: nearSubject.signerSlot
-			};
-	}
-	return assertNeverLoginState(args.selection);
-}
-function requireNearLoginWalletBinding(identity) {
-	if (identity.kind === "near_ed25519_capable_wallet") return identity;
-	throw new Error("[login] NEAR Ed25519 warm-up requires an exact NEAR subject");
-}
-function assertEcdsaWarmupMatchesUnlockSubjects(args) {
-	const allowedThresholdKeyIds = /* @__PURE__ */ new Set();
-	for (const subject of args.identity.subjectSet.subjects) if (subject.kind === "evm_family_ecdsa_wallet") allowedThresholdKeyIds.add(String(subject.ecdsaThresholdKeyId));
-	if (allowedThresholdKeyIds.size === 0) throw new Error("[login] ECDSA warm-up requires an exact ECDSA unlock subject");
-	for (const warmKey of args.context.ecdsaKeys) {
-		const thresholdKeyId = String(warmKey.key?.ecdsaThresholdKeyId || "").trim();
-		if (thresholdKeyId && !allowedThresholdKeyIds.has(thresholdKeyId)) throw new Error("[login] ECDSA warm-up key does not match the unlock subject set");
-	}
-}
-function ecdsaActivationSelectorsFromSubjectSet(subjectSet) {
-	const selectors = [];
-	for (const subject of subjectSet.subjects) {
-		if (subject.kind !== "evm_family_ecdsa_wallet") continue;
-		selectors.push({
-			capability: subject.capability,
-			authority: subject.authority
-		});
-	}
-	return selectors;
-}
-async function reconcileCanonicalEcdsaActivationSelectors(args) {
-	let didFinalize = false;
-	let pending = false;
-	for (const selector of args.selectors) {
-		const result = await reconcileCanonicalEcdsaActivationWasm({
-			workerCtx: args.workerCtx,
-			command: {
-				kind: "reconcile_canonical_ecdsa_activation_v1",
-				capability: selector.capability,
-				authority: selector.authority
-			}
-		});
-		switch (result.kind) {
-			case "canonical_ecdsa_activation_reconciliation_absent_v1": break;
-			case "canonical_ecdsa_activation_reconciliation_finalized_v1":
-				didFinalize = true;
-				break;
-			case "canonical_ecdsa_activation_reconciliation_pending_v1":
-				pending = true;
-				break;
-			case "canonical_ecdsa_activation_reconciliation_failed_v1": return {
-				kind: "failed",
-				didFinalize,
-				code: result.code
-			};
-			default: assertNeverLoginState(result);
-		}
-	}
-	return pending ? {
-		kind: "pending",
-		didFinalize
-	} : {
-		kind: "settled",
-		didFinalize
-	};
-}
-function reportNonSettledEcdsaActivationReconciliation(result) {
-	switch (result.kind) {
-		case "settled": return;
-		case "pending":
-			console.warn("[login] ECDSA activation remains prepared and requires confirmation");
-			return;
-		case "failed":
-			console.warn("[login] ECDSA activation reconciliation failed without changing active state", { code: result.code });
-			return;
-	}
-	assertNeverLoginState(result);
-}
-function walletAuthMethodBindingFromRecord(record) {
-	const wallet = buildWalletIdentity({ walletId: record.walletId });
-	switch (record.kind) {
-		case "passkey": {
-			const rpId = parseRpId(record.rpId);
-			if (!rpId.ok) return null;
-			return buildPasskeyWalletAuthMethodBinding({
-				walletAuthMethodId: record.walletAuthMethodId,
-				scope: buildPasskeyAuthScope({
-					wallet,
-					rpId: rpId.value
-				}),
-				credentialIdB64u: record.credentialIdB64u
-			});
-		}
-		case "email_otp": return buildEmailOtpWalletAuthMethodBinding({
-			walletAuthMethodId: record.walletAuthMethodId,
-			wallet,
-			emailHashHex: record.emailHashHex,
-			registrationAuthorityId: record.registrationAuthorityId
-		});
-		default: return null;
-	}
-}
-function walletAuthAuthorityForSelectedPasskeyMethod(record) {
-	return {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	};
-}
-async function walletAuthAuthorityRefForSelectedPasskeyMethod(record) {
-	return await walletAuthAuthorityRef({ authority: walletAuthAuthorityForSelectedPasskeyMethod(record) });
-}
-async function resolveExactLinkedEmailOtpAuthority(args) {
-	const authority = parseEmailOtpWalletAuthAuthority({
-		walletId: args.authMethod.walletId,
-		factor: {
-			kind: "email_otp",
-			provider: args.provider,
-			providerUserId: args.providerSubjectId
-		},
-		verifier: {
-			kind: "email_otp_wallet_auth_method",
-			emailHashHex: args.authMethod.emailHashHex
-		},
-		bindingId: args.authMethod.walletAuthMethodId
-	});
-	if (!authority) throw new Error("[login] linked Email OTP provider identity does not match selected authority");
-	return authority;
-}
-async function walletAuthAuthorityForLinkedDeviceMethod(args) {
-	if (args.selection.authMethod.kind === "passkey") return walletAuthAuthorityForSelectedPasskeyMethod(args.selection.authMethod);
-	const providerIdentity = args.providerIdentity;
-	if (!providerIdentity) throw new Error("[login] linked Email OTP authority provider identity is missing");
-	return await resolveExactLinkedEmailOtpAuthority({
-		authMethod: args.selection.authMethod,
-		provider: providerIdentity.provider,
-		providerSubjectId: providerIdentity.providerSubjectId
-	});
-}
-async function walletAuthAuthorityRefForLinkedDeviceMethod(args) {
-	return await walletAuthAuthorityRef({ authority: await walletAuthAuthorityForLinkedDeviceMethod(args) });
-}
-function selectedSignerMaterialForActivation(materials, authorityId, walletAuthMethodId, activation) {
-	let selected = null;
-	for (const material of materials) {
-		if (material.authorityId !== authorityId || material.walletAuthMethodId !== walletAuthMethodId || material.activationId !== activation.activationId) continue;
-		if (selected) return null;
-		selected = material;
-	}
-	return selected;
-}
-function linkedDeviceUnlockIdentityMismatchLabels(input) {
-	const failures = [];
-	if (input.selection.walletId !== input.walletId) failures.push("selection_wallet_id");
-	if (!input.allowUnselectedSibling && input.selection.walletAuthMethodId !== input.authMethod.walletAuthMethodId) failures.push("selection_auth_method_id");
-	if (input.authMethod.walletId !== input.walletId) failures.push("auth_method_wallet_id");
-	if (input.authMethod.status !== "active") failures.push("auth_method_inactive");
-	if (input.expectedKind && input.authMethod.kind !== input.expectedKind) failures.push(`auth_method_not_${input.expectedKind}`);
-	if (input.authority.walletId !== input.walletId) failures.push("authority_wallet_id");
-	if (input.authority.state !== "active") failures.push("authority_inactive");
-	if (input.authority.authorityId !== input.authMethod.walletAuthorityId) failures.push("authority_auth_method_id");
-	return failures;
-}
-async function resolveLinkedDevicePasskeyAuthoritySelection(walletIdInput) {
-	const parsedWalletId = parseWalletId(walletIdInput);
-	if (!parsedWalletId.ok) return null;
-	const walletId = parsedWalletId.value;
-	try {
-		const resolved = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-		if (resolved.kind !== "resolved") return null;
-		const { selection, authMethod, authority } = resolved;
-		if (linkedDeviceUnlockIdentityMismatchLabels({
-			walletId,
-			selection,
-			authMethod,
-			authority,
-			expectedKind: "passkey"
-		}).length > 0) return null;
-		if (authMethod.status !== "active" || authMethod.kind !== "passkey") return null;
-		if (authority.state !== "active") return null;
-		if (authority.provenance.kind !== "device_link") return null;
-		return {
-			kind: "linked_device_passkey_authority_selection_v1",
-			walletId,
-			selection,
-			authMethod,
-			authority,
-			signerMaterials: resolved.signerMaterials,
-			exportRoot: resolved.exportRoot
-		};
-	} catch {
-		return null;
-	}
-}
-async function resolveLinkedDeviceEmailOtpAuthoritySelection(args) {
-	const parsedWalletId = parseWalletId(args.walletIdInput);
-	const emailHashHex = String(args.emailHashHex || "").trim().toLowerCase();
-	const providerSubjectId = String(args.providerSubjectId || "").trim();
-	if (!parsedWalletId.ok || !emailHashHex || !providerSubjectId) return { kind: "none" };
-	const walletId = parsedWalletId.value;
-	let resolved;
-	try {
-		resolved = args.walletAuthMethodId ? await IndexedDBManager.resolveWalletAuthorityForMethod(String(walletId), args.walletAuthMethodId) : await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch (error) {
-		return {
-			kind: "rejected",
-			message: error instanceof Error ? error.message : "Selected Email OTP authority is unavailable"
-		};
-	}
-	if (resolved.kind === "missing_selection") return { kind: "none" };
-	if (resolved.kind !== "resolved") return {
-		kind: "rejected",
-		message: "Selected Email OTP authority is unavailable"
-	};
-	const { selection, authMethod, authority } = resolved;
-	if (authMethod.kind !== "email_otp") return { kind: "none" };
-	if (linkedDeviceUnlockIdentityMismatchLabels({
-		walletId,
-		selection,
-		authMethod,
-		authority,
-		expectedKind: "email_otp",
-		allowUnselectedSibling: Boolean(args.walletAuthMethodId)
-	}).length > 0 || authMethod.emailHashHex.toLowerCase() !== emailHashHex) return {
-		kind: "rejected",
-		message: "Selected Email OTP authority is inactive or does not match the verified email"
-	};
-	if (authMethod.status !== "active" || authority.state !== "active") return {
-		kind: "rejected",
-		message: "Selected Email OTP authority is inactive"
-	};
-	try {
-		await resolveExactLinkedEmailOtpAuthority({
-			authMethod,
-			provider: args.provider,
-			providerSubjectId
-		});
-	} catch (error) {
-		return {
-			kind: "rejected",
-			message: error instanceof Error ? error.message : "Selected Email OTP provider identity does not match the local authority"
-		};
-	}
-	if (authority.provenance.kind === "device_link" && resolved.signerMaterials.length === 0) return {
-		kind: "rejected",
-		message: "Selected linked Email OTP authority has no signer material"
-	};
-	if (resolved.signerMaterials.some((material) => material.kind !== "wallet_authority_linked_signer_material_v1")) return {
-		kind: "rejected",
-		message: "Selected Email OTP authority has an invalid linked signer material set"
-	};
-	return {
-		kind: "selected",
-		selection: {
-			kind: "linked_device_email_otp_authority_selection_v1",
-			walletId,
-			selection,
-			authMethod,
-			authority,
-			signerMaterials: resolved.signerMaterials,
-			exportRoot: resolved.exportRoot
-		}
-	};
-}
-function linkedDeviceActivationForCapability(authority, subject) {
-	const activation = subject.keyFamily === "ed25519" ? authority.signerActivations.ed25519 : authority.signerActivations.ecdsa;
-	if (!activation) throw new Error(`[login] linked Wallet Session requested unavailable ${subject.keyFamily} material`);
-	if (!mpcMaterialActivationRefsEqual(activation.materialActivation, subject.materialActivation)) throw new Error("[login] linked Wallet Session material activation does not match authority");
-	return activation.materialActivation;
-}
-function assertLinkedDeviceWalletSessionExact(selection, walletSession) {
-	if (walletSession.walletId !== selection.walletId || walletSession.authorityId !== selection.authority.authorityId || walletSession.authMethodId !== selection.authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== selection.authority.authorityDigestB64u || walletSession.authorityRevocationEpoch !== selection.authority.revocationEpoch) throw new Error("[login] linked Wallet Session identity does not match selected authority");
-	for (const subject of walletSession.capabilitySubjects) switch (subject.kind) {
-		case "sign":
-		case "export_keys": {
-			const activation = linkedDeviceActivationForCapability(selection.authority, subject);
-			const material = selectedSignerMaterialForActivation(selection.signerMaterials, selection.authority.authorityId, selection.authMethod.walletAuthMethodId, activation);
-			if (!material || material.keyFamily !== subject.keyFamily) throw new Error("[login] linked Wallet Session signer material is unavailable");
-			if (!mpcMaterialActivationRefsEqual(material.materialActivation, subject.materialActivation)) throw new Error("[login] linked Wallet Session signer material activation is invalid");
-			break;
-		}
-		case "link_devices":
-		case "revoke_devices": break;
-		default: return assertNeverLoginState(subject);
-	}
-}
-function assertLinkedPasskeyMaterialTargetFactor(material, selection) {
-	const target = material.targetFactor;
-	if (target.kind !== "passkey" || target.walletAuthMethodId !== selection.authMethod.walletAuthMethodId || target.rpId !== selection.authMethod.rpId || target.credentialIdB64u !== selection.authMethod.credentialIdB64u) throw new Error("[login] linked passkey signer material target factor does not match V2 auth");
-}
-async function openLinkedDeviceSignerMaterialsWithFactorSecret(args) {
-	if (args.factorSecret32.byteLength !== 32) throw new Error("[login] linked signer material requires a 32-byte factor secret");
-	const factorSecret = args.factorSecret32.slice();
-	try {
-		const opened = [];
-		for (const material of args.selection.signerMaterials) {
-			if (material.kind !== "wallet_authority_linked_signer_material_v1") throw new Error("[login] linked signer material is not a linked sealed record");
-			if (args.selection.kind === "linked_device_passkey_authority_selection_v1") assertLinkedPasskeyMaterialTargetFactor(material, args.selection);
-			else assertLinkedEmailOtpMaterialTargetFactor(material, args.selection);
-			const result = await openWalletAuthorityLinkedSignerMaterialV1({
-				record: material,
-				factorSecret,
-				expected: {
-					authorityId: args.selection.authority.authorityId,
-					walletId: args.selection.walletId,
-					walletAuthMethodId: args.selection.authMethod.walletAuthMethodId,
-					packageSetDigestB64u: material.packageSetDigestB64u,
-					targetFactor: material.targetFactor,
-					materialActivation: material.materialActivation,
-					keyFamily: material.keyFamily
-				}
-			});
-			if (result.kind !== "opened_wallet_authority_linked_signer_material_v1") throw new Error(`[login] linked signer material open failed: ${result.reason}`);
-			opened.push(result);
-		}
-		const [first, ...rest] = opened;
-		if (!first) throw new Error("[login] linked signer material set is empty");
-		return [first, ...rest];
-	} finally {
-		factorSecret.fill(0);
-	}
-}
-function assertLinkedEmailOtpMaterialTargetFactor(material, selection) {
-	const target = material.targetFactor;
-	if (target.kind !== "email_otp" || target.walletAuthMethodId !== selection.authMethod.walletAuthMethodId || target.emailHashHex.toLowerCase() !== selection.authMethod.emailHashHex.toLowerCase() || target.registrationAuthorityId !== selection.authMethod.registrationAuthorityId) throw new Error("[login] linked Email OTP signer material target factor does not match V2 auth");
-}
-async function openLinkedDeviceEmailOtpSignerMaterials(args) {
-	if (args.factorSecret32.byteLength !== 32) throw new Error("[login] linked Email OTP unlock requires a 32-byte factor secret");
-	return await openLinkedDeviceSignerMaterialsWithFactorSecret({
-		selection: args.selection,
-		factorSecret32: args.factorSecret32
-	});
-}
-function recentUnlockAccountFromUser(user) {
-	const walletId = String(user.walletId || "").trim();
-	if (!walletId) throw new Error("[login] recent unlock account is missing walletId");
-	const displayName = String(user.loginDisplayName || "").trim() || walletId;
-	return {
-		walletId,
-		nearAccountId: user.nearAccountId,
-		displayName,
-		signerSlot: user.signerSlot,
-		...typeof user.lastLogin === "number" ? { lastLogin: user.lastLogin } : {},
-		authMethod: user.authMethod || null
-	};
-}
-async function recentUnlockAccountFromLinkedDeviceSelection(selection) {
-	const resolved = await IndexedDBManager.resolveSelectedWalletAuthority(String(selection.walletId)).catch(() => null);
-	if (!resolved || resolved.kind !== "resolved" || resolved.selection.walletAuthMethodId !== selection.walletAuthMethodId || resolved.authMethod.status !== "active" || resolved.authority.state !== "active" || resolved.authority.provenance.kind !== "device_link") return null;
-	const nearSubject = await resolveLinkedDeviceNearUnlockSubject({
-		walletId: selection.walletId,
-		authMethod: resolved.authMethod,
-		authority: resolved.authority,
-		signerMaterials: resolved.signerMaterials
-	});
-	if (nearSubject.kind !== "resolved") return null;
-	let authMethod;
-	switch (resolved.authMethod.kind) {
-		case SIGNER_AUTH_METHODS.passkey:
-			authMethod = SIGNER_AUTH_METHODS.passkey;
-			break;
-		case SIGNER_AUTH_METHODS.emailOtp:
-			authMethod = SIGNER_AUTH_METHODS.emailOtp;
-			break;
-		default: return assertNeverLoginState(resolved.authMethod);
-	}
-	return {
-		walletId: String(selection.walletId),
-		nearAccountId: nearSubject.subject.nearAccountId,
-		displayName: String(selection.walletId),
-		signerSlot: nearSubject.subject.signerSlot,
-		lastLogin: selection.updatedAtMs,
-		authMethod
-	};
-}
-function recentUnlockAccountKey(account) {
-	return `${account.walletId}:${account.authMethod ?? ""}`;
-}
-function latestRecentUnlockAccount(accounts) {
-	let latest = null;
-	for (const account of accounts) if (!latest || (account.lastLogin ?? 0) > (latest.lastLogin ?? 0)) latest = account;
-	return latest;
-}
-async function readWalletAuthMethodBindingsForSession(walletId) {
-	if (!walletId) return [];
-	return (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(walletId)).catch(() => [])).filter((record) => record.status === "active").map(walletAuthMethodBindingFromRecord).filter((binding) => Boolean(binding));
-}
-function selectThresholdWarmupAuthMethodBinding(args) {
-	if (args.authMethod === SIGNER_AUTH_METHODS.passkey) return null;
-	if (args.authMethod !== SIGNER_AUTH_METHODS.emailOtp) throw new Error(`[login] unsupported wallet auth method for warm-up: ${args.authMethod}`);
-	const matches = args.authMethods.filter((binding) => binding.kind === "email_otp");
-	if (matches.length !== 1) throw new Error("[login] Email OTP warm-up requires one active wallet auth-method binding");
-	const binding = matches[0];
-	if (String(binding.wallet.walletId) !== String(args.walletId)) throw new Error("[login] Email OTP warm-up auth-method binding wallet mismatch");
-	return binding;
-}
-async function readThresholdWarmupAuthMethodBinding(args) {
-	return selectThresholdWarmupAuthMethodBinding({
-		authMethods: await readWalletAuthMethodBindingsForSession(args.walletId),
-		authMethod: args.authMethod,
-		walletId: args.walletId
-	});
-}
-async function readActiveWalletPasskeyAuthenticators(walletId) {
-	const [authenticators, authMethods] = await Promise.all([IndexedDBManager.listWalletPasskeyAuthenticators(String(walletId)), IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(walletId)).catch(() => [])]);
-	const activeCredentialIds = /* @__PURE__ */ new Set();
-	for (const method of authMethods) if (method.kind === "passkey" && method.status === "active") activeCredentialIds.add(method.credentialIdB64u);
-	return authenticators.filter((authenticator) => activeCredentialIds.has(authenticator.credentialId));
-}
-function isActiveThresholdLoginSigningSession(sessionStatus) {
-	return sessionStatus?.status === "active";
-}
-function resolveLoginEcdsaKeyFactsInventoryAuthority(args) {
-	if (!args.request) return null;
-	switch (args.request.mode) {
-		case "wallet_session_operation_credential_v1": try {
-			return {
-				kind: "wallet_session_operation_credential_v1",
-				operationCredential: parseLoginEcdsaInventoryOperationCredential(args.request.operationCredential)
-			};
-		} catch {
-			return null;
-		}
-		case "webauthn": return { kind: "webauthn" };
-	}
-	return null;
-}
-function parseLoginEcdsaInventoryOperationCredential(value) {
-	if (value.kind === "opaque_wallet_session_operation_credential_v1") return parseWalletSessionOperationCredentialV1(value);
-	if (value.kind !== "opaque_hosted_wallet_session_operation_credential_v1" || !/^wsh_[A-Za-z0-9_-]{43}$/.test(value.token)) throw new Error("Hosted Wallet Session operation credential is invalid");
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	if (!walletSessionId.ok) throw new Error(`Hosted Wallet Session ID is invalid: ${walletSessionId.error.message}`);
-	return {
-		kind: value.kind,
-		token: value.token,
-		walletSessionId: walletSessionId.value
-	};
-}
-function resolveLoginWarmupRouteAuthorization() {
-	return { kind: "none" };
-}
-function loginPasskeyCredentialIdB64u(args) {
-	return String(args.authenticators.find((authenticator) => authenticator.signerSlot === args.signerSlot)?.credentialId || args.authenticators[0]?.credentialId || "").trim();
-}
-function buildLoginPasskeyWalletAuthAuthority(args) {
-	return buildPasskeyWalletAuthAuthority({
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credentialIdB64u: args.credentialIdB64u
-	});
-}
-function resolveLoginEd25519SessionAuthority(args) {
-	if (!args.wantsEd25519Warmup) return { kind: "not_requested" };
-	if (args.authMethod === SIGNER_AUTH_METHODS.passkey) return {
-		kind: "passkey",
-		authority: {
-			kind: "wallet_auth_authority",
-			authority: buildLoginPasskeyWalletAuthAuthority({
-				walletId: args.walletId,
-				rpId: args.rpId,
-				credentialIdB64u: args.passkeyCredentialIdB64u
-			})
-		},
-		source: "login"
-	};
-	if (args.authMethod === SIGNER_AUTH_METHODS.emailOtp) throw new Error("[login] Email OTP warm-up requires its proof-bound unlock flow");
-	throw new Error(`[login] unsupported wallet auth method for Ed25519 warm-up: ${args.authMethod}`);
-}
-function requireRequestedLoginEd25519SessionAuthority(authority) {
-	if (authority.kind === "not_requested") throw new Error("[login] threshold Ed25519 warm-up authority is missing");
-	return authority;
-}
-function bindLoginEd25519SessionAuthorityToAuthenticatedCredential(args) {
-	if (args.authority.kind === "email_otp") return args.authority;
-	return {
-		kind: "passkey",
-		authority: {
-			kind: "wallet_auth_authority",
-			authority: buildLoginPasskeyWalletAuthAuthority({
-				walletId: args.walletId,
-				rpId: args.rpId,
-				credentialIdB64u: args.credentialIdB64u
-			})
-		},
-		source: "login"
-	};
-}
-function loginEd25519ExactProvisionAuthBinding(authority) {
-	switch (authority.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			rpId: toRpId(authority.authority.authority.verifier.rpId),
-			credentialIdB64u: String(authority.authority.authority.factor.credentialIdB64u || "").trim()
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			providerSubjectId: String(authority.authority.authority.factor.providerUserId || "").trim()
-		};
-	}
-	throw new Error("[login] unsupported Ed25519 exact provision authority");
-}
-function loginEd25519ExactProvisionLaneIdentity(args) {
-	return exactEd25519SigningLaneIdentity({
-		signer: nearEd25519SignerBindingFromBoundaryFields({
-			walletId: args.walletBinding.walletId,
-			nearAccountId: args.walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: args.walletBinding.nearEd25519SigningKeyId,
-			signerSlot: args.signerSlot
-		}),
-		auth: loginEd25519ExactProvisionAuthBinding(args.authority),
-		walletSessionId: args.walletSessionId,
-		quotaId: args.quotaId,
-		thresholdSessionId: args.thresholdSessionId
-	});
-}
-function resolveLoginWarmEd25519ProvisioningIdentity(args) {
-	switch (args.mintPlan.kind) {
-		case "not_requested": throw new Error("[login] threshold Ed25519 mint plan is missing");
-		case "wallet_custody":
-			if (args.ecdsaMint) return {
-				kind: "exact_ed25519_provisioning",
-				operationCredential: args.ecdsaMint.operationCredential,
-				laneIdentity: loginEd25519ExactProvisionLaneIdentity({
-					walletBinding: args.walletBinding,
-					signerSlot: args.signerSlot,
-					thresholdSessionId: args.mintPlan.thresholdSessionId,
-					walletSessionId: args.ecdsaMint.operationCredential.walletSessionId,
-					quotaId: args.ecdsaMint.quotaId,
-					authority: args.authority
-				})
-			};
-			return {
-				kind: "fresh_ed25519_provisioning",
-				materialActivation: args.mintPlan.custody.ed25519.capability.materialActivation
-			};
-		case "fresh": throw new Error("[login] fresh Ed25519 passkey provisioning requires canonical material activation");
-		case "ecdsa_authorized":
-			if (!args.ecdsaMint) throw new Error("[login] threshold Ed25519 warm-up requires the ECDSA bootstrap session minted during unlock");
-			return {
-				kind: "exact_ed25519_provisioning",
-				operationCredential: args.ecdsaMint.operationCredential,
-				laneIdentity: loginEd25519ExactProvisionLaneIdentity({
-					walletBinding: args.walletBinding,
-					signerSlot: args.signerSlot,
-					thresholdSessionId: args.mintPlan.thresholdSessionId,
-					walletSessionId: args.ecdsaMint.operationCredential.walletSessionId,
-					quotaId: args.ecdsaMint.quotaId,
-					authority: args.authority
-				})
-			};
-	}
-	return assertNeverLoginState(args.mintPlan);
-}
-function resolveLoginPasskeyMaterialActivation(identity, mintPlan) {
-	if (identity.kind === "fresh_ed25519_provisioning" && identity.materialActivation) return identity.materialActivation;
-	if (mintPlan.kind === "wallet_custody") return mintPlan.custody.ed25519.capability.materialActivation;
-	throw new Error("[login] passkey Ed25519 warm-up requires a canonical material activation");
-}
-function resolveLoginEd25519ProvisionScope(args) {
-	if (args.mintPlan.kind !== "wallet_custody") return args.fallback;
-	return {
-		relayerKeyId: args.mintPlan.custody.ed25519.relayerKeyId,
-		participantIds: args.mintPlan.custody.ed25519.participantIds,
-		runtimePolicyScope: args.mintPlan.custody.ed25519.capability.runtimePolicyScope,
-		routerAbNormalSigning: args.fallback.routerAbNormalSigning
-	};
-}
-function passkeyUnlockEd25519Connection(args) {
-	const session = args.session;
-	const custody = args.custody.ed25519;
-	const passkeyPrfFirstB64u = args.credential ? passkeyPrfFirstB64uFromCredential(args.credential) : "";
-	if (session.walletId !== String(args.walletBinding.walletId) || session.nearAccountId !== String(args.walletBinding.nearAccountId) || session.nearEd25519SigningKeyId !== String(args.walletBinding.nearEd25519SigningKeyId) || custody.signerSlot !== args.signerSlot || session.relayerKeyId !== args.provisionScope.relayerKeyId || session.thresholdSessionId !== custody.capability.lifecycle.thresholdSessionId || session.remainingUses !== args.remainingUses || !sameEd25519ParticipantIds(session.participantIds, args.provisionScope.participantIds) || !args.provisionScope.runtimePolicyScope || !sameThresholdRuntimePolicyScope(session.runtimePolicyScope, args.provisionScope.runtimePolicyScope) || !sameRouterAbEd25519NormalSigningState(session.routerAbNormalSigning, args.provisionScope.routerAbNormalSigning) || !passkeyPrfFirstB64u) throw new Error("[login] verified unlock returned an invalid Ed25519 Wallet Session");
-	switch (session.sessionKind) {
-		case "issued_exact_wallet_session":
-			if (session.operationCredential.walletSessionId !== session.walletSessionId) throw new Error("[login] verified unlock returned a mismatched Ed25519 credential");
-			return {
-				ok: true,
-				...session,
-				passkeyPrfFirstB64u
-			};
-		case "already_committed_exact_wallet_session": {
-			const authorization = args.unlockAuthorization;
-			if (!authorization) throw new Error("[login] verified unlock reused an Ed25519 Wallet Session without its authorization");
-			if (authorization.operationCredential.walletSessionId !== session.walletSessionId || authorization.record.walletId !== session.walletId || authorization.record.authorizationId !== session.authorizationId || authorization.record.quotaId !== session.quotaId || authorization.record.expiresAtMs !== session.expiresAtMs) throw new Error("[login] verified unlock reused a mismatched Ed25519 Wallet Session");
-			return {
-				ok: true,
-				...session,
-				operationCredential: authorization.operationCredential,
-				passkeyPrfFirstB64u
-			};
-		}
-		default: return assertNeverLoginState(session);
-	}
-}
-function resolveLoginNoServerSessionPasskeyCredentialPlan(args) {
-	if (args.hasLoginCredential) return { kind: "passkey_credential_already_collected" };
-	if (!args.requiresLocalPasskeyUnlock) return { kind: "no_local_passkey_required" };
-	if (args.requireThresholdWarmup) return { kind: "wallet_unlock_owns_passkey_credential" };
-	return { kind: "local_unlock_passkey_assertion" };
-}
-function resolveLoginWarmupPasskeyCredentialPlan(args) {
-	if (args.warmupPlan.signersToWarm.includes("ed25519") && args.requiresLocalPasskeyUnlock) return { kind: "wallet_custody" };
-	if (args.hasLoginCredential) return { kind: "existing_passkey_credential" };
-	args.routeAuthorization.kind;
-	if (args.requiresLocalPasskeyUnlock) throw new Error("[login] passkey warm-up requires the verified wallet-unlock credential");
-	return { kind: "no_passkey_credential_required" };
-}
-function authenticatorsForCredentialIds(args) {
-	if (!args.credentialIds) return args.authenticators;
-	const allowed = /* @__PURE__ */ new Set();
-	for (const credentialId of args.credentialIds) allowed.add(credentialId.trim());
-	const authenticators = [];
-	for (const authenticator of args.authenticators) if (allowed.has(String(authenticator.credentialId || "").trim())) authenticators.push(authenticator);
-	if (!authenticators.length) throw new Error("[login] no local authenticator matches the required credential");
-	return authenticators;
-}
-function uniqueLoginCredentialIds(authenticators) {
-	const credentialIds = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const authenticator of authenticators) {
-		const credentialId = String(authenticator.credentialId || "").trim();
-		if (!credentialId || seen.has(credentialId)) continue;
-		seen.add(credentialId);
-		credentialIds.push(credentialId);
-	}
-	return credentialIds;
-}
-function parseLoginChallengeCredentialIds(value) {
-	if (!Array.isArray(value)) return [];
-	const credentialIds = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) {
-		const credentialId = typeof entry === "string" ? entry.trim() : "";
-		if (!credentialId || seen.has(credentialId)) continue;
-		seen.add(credentialId);
-		credentialIds.push(credentialId);
-	}
-	return credentialIds;
-}
-function resolveLoginPasskeyPromptCredentialIds(args) {
-	const signerAuthenticators = [];
-	for (const authenticator of args.authenticators) if (authenticator.signerSlot === args.signerSlot) signerAuthenticators.push(authenticator);
-	const localCredentialIds = uniqueLoginCredentialIds(signerAuthenticators.length > 0 ? signerAuthenticators : args.authenticators);
-	if (localCredentialIds.length === 0) throw new Error("[login] selected wallet has no local passkey credential ID");
-	if (args.serverCredentialIds.length === 0) return localCredentialIds;
-	const serverCredentialIds = new Set(args.serverCredentialIds);
-	const matchingCredentialIds = [];
-	for (const credentialId of localCredentialIds) if (serverCredentialIds.has(credentialId)) matchingCredentialIds.push(credentialId);
-	if (matchingCredentialIds.length === 0) throw new Error("[login] server passkey allow-list does not match local wallet credentials");
-	return matchingCredentialIds;
-}
-function resolveLoginUnlockWarmupBranchPlan(args) {
-	const identity = resolveLoginWalletIdentity({
-		subjectSet: args.subjectSet,
-		selection: args.selection
-	});
-	switch (args.selection.mode) {
-		case "ed25519_only": return {
-			kind: "near_ed25519_only",
-			wantsEd25519Warmup: true,
-			wantsEcdsaWarmup: false
-		};
-		case "ecdsa_only":
-			if (identity.kind !== "evm_family_ecdsa_only_wallet") throw new Error("[login] ECDSA-only warm-up requires exact ECDSA subjects");
-			return {
-				kind: "evm_family_ecdsa_only",
-				wantsEd25519Warmup: false,
-				wantsEcdsaWarmup: args.hasConfiguredEcdsaTargets
-			};
-		case "ed25519_and_ecdsa": return {
-			kind: "near_ed25519_and_evm_family_ecdsa",
-			wantsEd25519Warmup: true,
-			wantsEcdsaWarmup: args.hasConfiguredEcdsaTargets
-		};
-	}
-	return assertNeverLoginState(args.selection);
-}
-function resolveThresholdLoginWarmupPhaseInput(args) {
-	const relayerUrl = String(args.context.configs?.network.relayer?.url || "").trim();
-	if (!relayerUrl) throw new Error("[login] threshold warm session requires relayer.url to be configured");
-	const configuredEcdsaTargets = listConfiguredThresholdEcdsaPublicationTargets(args.context.configs.network.chains);
-	const branchPlan = resolveLoginUnlockWarmupBranchPlan({
-		subjectSet: args.subjectSet,
-		selection: args.selection,
-		hasConfiguredEcdsaTargets: configuredEcdsaTargets.length > 0
-	});
-	const wantsEcdsaWarmup = branchPlan.wantsEcdsaWarmup;
-	const wantsEd25519Warmup = branchPlan.wantsEd25519Warmup;
-	const rpId = String(args.context.signingEngine.getRpId() || "").trim();
-	return {
-		kind: "threshold_login_warmup_phase_input",
-		signerSlot: args.signerSlot,
-		selection: args.selection,
-		relayerUrl,
-		rpId,
-		configuredEcdsaTargets,
-		selectedEcdsaTargets: wantsEcdsaWarmup ? configuredEcdsaTargets : [],
-		wantsEd25519Warmup,
-		wantsEcdsaWarmup,
-		ed25519SessionAuthority: resolveLoginEd25519SessionAuthority({
-			wantsEd25519Warmup,
-			authMethod: args.authMethod,
-			walletId: args.subjectSet.walletId,
-			rpId,
-			passkeyCredentialIdB64u: loginPasskeyCredentialIdB64u({
-				authenticators: args.authenticators,
-				signerSlot: args.signerSlot
-			}),
-			routeAuthorization: args.routeAuthorization
-		}),
-		keyFactsInventoryAuthority: args.keyFactsInventoryAuthority,
-		routeAuthorization: args.routeAuthorization
-	};
-}
-async function assertPasskeyUnlockRuntimePostconditions(args) {
-	const requiredTargets = [...args.signersWarmed.includes("ed25519") ? [{ curve: "ed25519" }] : [], ...args.signersWarmed.includes("ecdsa") ? listConfiguredThresholdEcdsaPublicationTargets(args.context.configs.network.chains).map((target) => ({
-		curve: "ecdsa",
-		chainTarget: target.chainTarget
-	})) : []];
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(args.credential);
-	if (!credentialIdB64u) throw new Error("[login] runtime lane selection requires the authenticated credential");
-	const walletId = String(args.walletIdentity.walletId);
-	const authenticator = await IndexedDBManager.getWalletPasskeyAuthenticator({
-		walletId,
-		credentialId: credentialIdB64u
-	});
-	const derivedSignerSlot = parseSignerSlot(authenticator?.signerSlot, { min: 1 });
-	if (!authenticator || derivedSignerSlot === null) throw new Error("[login] authenticated credential resolves no exact local authenticator for its signer slot");
-	const ownerScope = {
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.context.signingEngine.getRpId()),
-			credentialIdB64u
-		},
-		signerSlot: derivedSignerSlot
-	};
-	if (requiredTargets.length === 0) return;
-	await assertWalletRuntimePostconditions({
-		source: "wallet_unlock",
-		walletId: String(args.walletIdentity.walletId),
-		ownerScope,
-		requiredTargets,
-		readOwnerScopedSigningLanes: async (input) => await args.context.signingEngine.readOwnerScopedSigningLanes(input, args.statusReads)
-	});
-}
-async function markPasskeyLoginSelectionUnlocked(args) {
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(args.credential);
-	if (!credentialIdB64u) throw new Error("[login] successful Passkey unlock omitted its credential identity");
-	const authority = await exactPasskeyWalletAuthAuthorityRefForCredential({
-		walletId: args.walletIdentity.walletId,
-		rpId: args.context.signingEngine.getRpId(),
-		credentialIdB64u
-	});
-	await args.context.signingEngine.markWalletSelectionUnlocked({
-		walletId: args.walletIdentity.walletId,
-		walletAuthMethodId: authority.walletAuthMethodId
-	});
-}
-function buildNearLoginUnlockAccountSubject(args) {
-	if (args.userData && String(args.userData.walletId) !== String(args.walletId)) throw new Error("[login] NEAR account projection belongs to a different wallet");
-	const operationalPublicKey = typeof args.userData?.operationalPublicKey === "string" ? args.userData.operationalPublicKey.trim() : "";
-	return {
-		kind: "near_wallet",
-		walletId: args.walletId,
-		operationalPublicKey: operationalPublicKey || null
-	};
-}
-async function readNearLoginUnlockAccountPhase(args) {
-	emitUnlockEvent(args.onEvent, String(args.identity.nearAccountId), {
-		phase: UnlockEventPhase.STEP_02_ACCOUNT_LOOKUP_STARTED,
-		status: "running",
-		authMethod: "passkey"
-	});
-	const hintUserPromise = args.signerSlotHint !== null ? args.signingEngine.getUserBySignerSlot(args.identity.nearAccountId, args.signerSlotHint).catch(() => null) : Promise.resolve(null);
-	const [hintUser, lastUser, latestByAccount, authenticators] = await Promise.all([
-		hintUserPromise,
-		args.signingEngine.getLastUser().catch(() => null),
-		getNearAccountProjection(IndexedDBManager, args.identity.nearAccountId).catch(() => null),
-		readActiveWalletPasskeyAuthenticators(args.identity.walletId)
-	]);
-	if (authenticators.length === 0) throw new Error(`No authenticators found for account ${args.identity.nearAccountId}. Please register an account.`);
-	let userData = null;
-	if (hintUser && hintUser.nearAccountId === args.identity.nearAccountId) userData = hintUser;
-	else if (latestByAccount && latestByAccount.nearAccountId === args.identity.nearAccountId) userData = latestByAccount;
-	else if (lastUser && lastUser.nearAccountId === args.identity.nearAccountId) userData = lastUser;
-	else userData = await args.signingEngine.getUserBySignerSlot(args.identity.nearAccountId, Number(args.identity.signerSlot)).catch(() => null);
-	const accountSubject = buildNearLoginUnlockAccountSubject({
-		userData,
-		walletId: args.identity.walletId
-	});
-	emitUnlockEvent(args.onEvent, String(args.identity.nearAccountId), {
-		phase: UnlockEventPhase.STEP_02_ACCOUNT_LOOKUP_SUCCEEDED,
-		status: "succeeded",
-		authMethod: "passkey",
-		data: {
-			signerSlot: Number(args.identity.signerSlot),
-			...accountSubject.operationalPublicKey ? { operationalPublicKey: accountSubject.operationalPublicKey } : { walletKind: accountSubject.kind }
-		}
-	});
-	return {
-		kind: "login_unlock_account_phase_ready",
-		accountSubject,
-		authenticators,
-		baseSignerSlot: args.signerSlotHint ?? Number(args.identity.signerSlot),
-		localUnlockAuthMethod: SIGNER_AUTH_METHODS.passkey,
-		requiresLocalPasskeyUnlock: true
-	};
-}
-async function readEcdsaLoginUnlockAccountPhase(args) {
-	const unlockSubjectId = String(args.identity.walletId);
-	emitUnlockEvent(args.onEvent, unlockSubjectId, {
-		phase: UnlockEventPhase.STEP_02_ACCOUNT_LOOKUP_STARTED,
-		status: "running",
-		authMethod: "passkey"
-	});
-	const [profile, eligibleAuthenticators] = await Promise.all([IndexedDBManager.getProfile(unlockSubjectId), readActiveWalletPasskeyAuthenticators(args.identity.walletId)]);
-	if (!profile || eligibleAuthenticators.length === 0) throw new Error(`[login] ECDSA wallet ${unlockSubjectId} has no local passkey profile`);
-	const persistedSignerSlot = parseSignerSlot(profile.defaultSignerSlot, { min: 1 });
-	const baseSignerSlot = args.signerSlotHint ?? persistedSignerSlot;
-	if (baseSignerSlot === null) throw new Error("[login] ECDSA wallet profile is missing its exact signerSlot");
-	emitUnlockEvent(args.onEvent, unlockSubjectId, {
-		phase: UnlockEventPhase.STEP_02_ACCOUNT_LOOKUP_SUCCEEDED,
-		status: "succeeded",
-		authMethod: "passkey",
-		data: {
-			signerSlot: baseSignerSlot,
-			walletKind: "ecdsa_wallet_only"
-		}
-	});
-	return {
-		kind: "login_unlock_account_phase_ready",
-		accountSubject: {
-			kind: "ecdsa_wallet_only",
-			walletId: args.identity.walletId,
-			operationalPublicKey: null
-		},
-		authenticators: eligibleAuthenticators,
-		baseSignerSlot,
-		localUnlockAuthMethod: SIGNER_AUTH_METHODS.passkey,
-		requiresLocalPasskeyUnlock: true
-	};
-}
-async function readLoginUnlockAccountPhase(args) {
-	switch (args.identity.kind) {
-		case "near_ed25519_capable_wallet": return await readNearLoginUnlockAccountPhase({
-			signingEngine: args.signingEngine,
-			identity: args.identity,
-			signerSlotHint: args.signerSlotHint,
-			onEvent: args.onEvent
-		});
-		case "evm_family_ecdsa_only_wallet": return await readEcdsaLoginUnlockAccountPhase({
-			identity: args.identity,
-			signerSlotHint: args.signerSlotHint,
-			onEvent: args.onEvent
-		});
-	}
-	return assertNeverLoginState(args.identity);
-}
-function buildSuccessfulLoginResult(args) {
-	switch (args.identity.kind) {
-		case "near_ed25519_capable_wallet":
-			if (args.accountSubject.kind !== "near_wallet") throw new Error("[login] NEAR unlock returned an ECDSA-only account subject");
-			return {
-				success: true,
-				kind: "near_wallet_unlocked",
-				walletId: args.identity.walletId,
-				loggedInNearAccountId: String(args.identity.nearAccountId),
-				operationalPublicKey: args.accountSubject.operationalPublicKey,
-				nearAccountId: args.identity.nearAccountId
-			};
-		case "evm_family_ecdsa_only_wallet":
-			if (args.accountSubject.kind !== "ecdsa_wallet_only") throw new Error("[login] ECDSA-only unlock returned a NEAR account subject");
-			return {
-				success: true,
-				kind: "ecdsa_wallet_unlocked",
-				walletId: args.identity.walletId
-			};
-	}
-	return assertNeverLoginState(args.identity);
-}
-async function unlockResolvedWalletSubjectSet(context, subjectSet, options) {
-	return await unlockInternal(context, subjectSet, options, { kind: "wallet_only" });
-}
-async function resolveLinkedDeviceNearUnlockSubject(args) {
-	const activation = args.authority.signerActivations.ed25519;
-	if (!activation) return { kind: "absent" };
-	const material = selectedSignerMaterialForActivation(args.signerMaterials, args.authority.authorityId, args.authMethod.walletAuthMethodId, activation.materialActivation);
-	if (!material || material.kind !== "wallet_authority_linked_signer_material_v1" || material.keyFamily !== "ed25519" || !mpcMaterialActivationRefsEqual(material.materialActivation, activation.materialActivation)) return { kind: "invalid" };
-	const application = material.publicFacts.applicationBinding;
-	if (application.wallet_id !== String(args.walletId)) return { kind: "invalid" };
-	let match = null;
-	const references = await new IndexedDbEd25519YaoPublicCapabilityReferenceStore(IndexedDBManager).listLanes();
-	for (const reference of references) {
-		let factorMatches;
-		switch (args.authMethod.kind) {
-			case SIGNER_AUTH_METHODS.passkey:
-				factorMatches = reference.auth.kind === SIGNER_AUTH_METHODS.passkey && String(reference.auth.rpId) === String(args.authMethod.rpId) && String(reference.auth.credentialIdB64u) === String(args.authMethod.credentialIdB64u);
-				break;
-			case SIGNER_AUTH_METHODS.emailOtp:
-				factorMatches = reference.auth.kind === SIGNER_AUTH_METHODS.emailOtp;
-				break;
-			default: return assertNeverLoginState(args.authMethod);
-		}
-		if (!factorMatches || String(reference.walletId) !== String(args.walletId) || reference.signerSlot !== application.key_creation_signer_slot || String(reference.nearEd25519SigningKeyId) !== application.near_ed25519_signing_key_id || String(reference.thresholdSessionId) !== material.publicFacts.targetBinding.lifecycle.session_id || !mpcMaterialActivationRefsEqual(reference.materialActivation, activation.materialActivation)) continue;
-		if (match) return { kind: "invalid" };
-		match = reference;
-	}
-	if (!match) return { kind: "invalid" };
-	const signerSlot = parseSignerSlot(match.signerSlot, { min: 1 });
-	if (!signerSlot) return { kind: "invalid" };
-	return {
-		kind: "resolved",
-		subject: {
-			kind: "near_ed25519_wallet",
-			walletId: args.walletId,
-			nearAccountId: match.nearAccountId,
-			nearEd25519SigningKeyId: match.nearEd25519SigningKeyId,
-			signerSlot
-		}
-	};
-}
-/**
-* The exact authority reference for a linked device whose factor carries no
-* local credential. It names the authority by its own digest and the exact
-* auth method, so it cannot be reconstructed from factor fields several
-* methods may share.
-*/
-function requireLinkedDeviceWalletAuthAuthorityRef(input) {
-	const authorityRef = parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: input.authority.walletId,
-		authorityDigest: input.authority.authorityDigestB64u,
-		walletAuthMethodId: input.authMethod.walletAuthMethodId
-	});
-	if (!authorityRef) throw new Error("[login] linked device wallet authority reference is invalid");
-	return authorityRef;
-}
-async function resolveLinkedDeviceUnlockSubjectSet(walletIdInput) {
-	const parsedWalletId = parseWalletId(walletIdInput);
-	if (!parsedWalletId.ok) return null;
-	const walletId = parsedWalletId.value;
-	try {
-		const resolved = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-		if (resolved.kind !== "resolved") return null;
-		const { selection, authMethod, authority } = resolved;
-		if (linkedDeviceUnlockIdentityMismatchLabels({
-			walletId,
-			selection,
-			authMethod,
-			authority
-		}).length > 0) return null;
-		if (authMethod.status !== "active") return null;
-		if (authority.state !== "active") return null;
-		const subjects = [];
-		const nearSubject = await resolveLinkedDeviceNearUnlockSubject({
-			walletId,
-			authMethod,
-			authority,
-			signerMaterials: resolved.signerMaterials
-		});
-		if (nearSubject.kind === "invalid") return null;
-		if (nearSubject.kind === "resolved") subjects.push(nearSubject.subject);
-		const ecdsaActivation = authority.signerActivations.ecdsa;
-		if (ecdsaActivation) {
-			const ecdsaMaterial = selectedSignerMaterialForActivation(resolved.signerMaterials, authority.authorityId, authMethod.walletAuthMethodId, ecdsaActivation.materialActivation);
-			if (!ecdsaMaterial || ecdsaMaterial.keyFamily !== "ecdsa_secp256k1") return null;
-			if (!mpcMaterialActivationRefsEqual(ecdsaMaterial.materialActivation, ecdsaActivation.materialActivation)) return null;
-			let authorityRef;
-			try {
-				authorityRef = authMethod.kind === SIGNER_AUTH_METHODS.passkey ? await walletAuthAuthorityRefForSelectedPasskeyMethod(authMethod) : requireLinkedDeviceWalletAuthAuthorityRef({
-					authority,
-					authMethod
-				});
-			} catch {
-				return null;
-			}
-			subjects.push({
-				kind: "evm_family_ecdsa_wallet",
-				walletId,
-				capability: ecdsaActivation.materialActivation.capability,
-				authority: authorityRef,
-				ecdsaThresholdKeyId: ecdsaMaterial.ecdsaThresholdKeyId
-			});
-		}
-		const firstSubject = subjects[0];
-		if (!firstSubject) return null;
-		return {
-			kind: "wallet_unlock_subject_set",
-			walletId,
-			subjects: [firstSubject, ...subjects.slice(1)]
-		};
-	} catch {
-		return null;
-	}
-}
-function linkedDeviceRuntimeRequiresCurve(walletSession, curve) {
-	return walletSession.capabilitySubjects.some((subject) => (subject.kind === "sign" || subject.kind === "export_keys") && subject.keyFamily === (curve === "ed25519" ? "ed25519" : "ecdsa_secp256k1"));
-}
-function linkedDeviceEd25519Material(materials) {
-	const matches = materials.filter((material) => material.keyFamily === "ed25519");
-	if (matches.length > 1) throw new Error("[login] linked passkey has multiple active Ed25519 materials");
-	return matches[0] ?? null;
-}
-function linkedDeviceEcdsaMaterial(materials) {
-	const matches = materials.filter((material) => material.keyFamily === "ecdsa_secp256k1");
-	if (matches.length > 1) throw new Error("[login] linked passkey has multiple active ECDSA materials");
-	return matches[0] ?? null;
-}
-async function activateLinkedDeviceEcdsaHolderRuntime(args) {
-	const existing = resolveLinkedEcdsaHolderRuntimeV1({
-		walletId: args.selection.walletId,
-		materialActivation: args.material.materialActivation
-	});
-	if (existing) {
-		const [existingAuthorityRef, requestedAuthorityRef] = await Promise.all([walletAuthAuthorityRef({ authority: existing.factorAuthority }), walletAuthAuthorityRef({ authority: args.factorAuthority })]);
-		if (existing.authorityId !== args.selection.authority.authorityId || existing.walletAuthMethodId !== args.selection.authMethod.walletAuthMethodId || existing.ecdsaThresholdKeyId !== args.material.publicFacts.ecdsaThresholdKeyId || existingAuthorityRef.authorityDigest !== requestedAuthorityRef.authorityDigest) throw new Error("[login] linked ECDSA holder runtime conflicts with the selected authority");
-		return {
-			runtime: existing,
-			installed: false
-		};
-	}
-	const holderHandleId = secureRandomId("linked-ecdsa-holder");
-	try {
-		const stored = await storeLinkedDeviceEcdsaHolderMaterialWasm({
-			holderHandleId,
-			ownedSigningShare32: args.material.material.slice(),
-			activationReceiptJson: JSON.stringify(args.material.publicFacts.activationReceipt),
-			workerCtx: args.context.signingEngine.getSignerWorkerContext()
-		});
-		const runtime = {
-			kind: "linked_ecdsa_holder_runtime_v1",
-			walletId: args.selection.walletId,
-			authorityId: args.selection.authority.authorityId,
-			walletAuthMethodId: args.selection.authMethod.walletAuthMethodId,
-			factorAuthority: args.factorAuthority,
-			materialActivation: args.material.materialActivation,
-			holderHandleId: stored.holderHandleId,
-			ecdsaThresholdKeyId: args.material.publicFacts.ecdsaThresholdKeyId,
-			activationReceipt: args.material.publicFacts.activationReceipt
-		};
-		installLinkedEcdsaHolderRuntimeV1(runtime);
-		return {
-			runtime,
-			installed: true
-		};
-	} catch (error) {
-		await destroyLinkedDeviceEcdsaHolderMaterialWasm({
-			holderHandleId,
-			workerCtx: args.context.signingEngine.getSignerWorkerContext()
-		}).catch(() => void 0);
-		throw error;
-	}
-}
-async function resolveLinkedDevicePostLinkSelection(factor) {
-	if (factor.kind === "passkey") {
-		const selection = await resolveLinkedDevicePasskeyAuthoritySelection(String(factor.walletId));
-		if (!selection) throw new Error("[login] linked Passkey authority is unavailable after link");
-		return selection;
-	}
-	const resolution = await resolveLinkedDeviceEmailOtpAuthoritySelection({
-		walletIdInput: String(factor.walletId),
-		walletAuthMethodId: String(factor.walletAuthMethodId),
-		emailHashHex: factor.emailHashHex,
-		provider: factor.providerIdentity.provider,
-		providerSubjectId: factor.providerIdentity.providerSubjectId
-	});
-	if (resolution.kind !== "selected") throw new Error(resolution.kind === "rejected" ? resolution.message : "[login] linked Email OTP authority is unavailable after link");
-	return resolution.selection;
-}
-async function linkedDeviceEd25519SessionAfterLink(args) {
-	const metadata = linkedDeviceEd25519Metadata(args.material);
-	const nearAccountId = deriveImplicitNearAccountIdFromEd25519PublicKey(`ed25519:${base58Encode(metadata.registeredPublicKey)}`);
-	const requestResult = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1({
-		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
-		walletId: String(args.selection.walletId),
-		nearAccountId,
-		nearEd25519SigningKeyId: metadata.applicationBinding.near_ed25519_signing_key_id,
-		signerSlot: metadata.applicationBinding.key_creation_signer_slot,
-		thresholdSessionId: metadata.scope.threshold_session_id,
-		signingWorkerId: metadata.scope.signing_worker_id,
-		participantIds: metadata.participantIds
-	});
-	if (!requestResult.ok) throw new Error(requestResult.message);
-	const response = await fetch(`${new URL(args.relayerUrl).origin}${ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${args.operationCredential.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(requestResult.value)
-	});
-	const raw = await response.json().catch(() => null);
-	if (!response.ok || !isObject(raw)) {
-		const message = isObject(raw) ? String(raw.message || "").trim() : "";
-		throw new Error(`[login] linked Ed25519 post-link bootstrap failed (HTTP ${response.status}): ${message || "invalid response"}`);
-	}
-	const thresholdSessionId = parseThresholdEd25519SessionId(raw.thresholdSessionId);
-	const walletSessionId = parseWalletSessionId(raw.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(raw.quotaId);
-	const runtimePolicyScope = normalizeRuntimePolicyScope(raw.runtimePolicyScope);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(raw.routerAbNormalSigning);
-	const participantIds = Array.isArray(raw.participantIds) ? raw.participantIds : [];
-	if (raw.kind !== "router_ab_ed25519_yao_warm_recovery_bootstrap_v1" && raw.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1" || String(raw.walletId) !== String(args.selection.walletId) || String(raw.nearAccountId) !== requestResult.value.nearAccountId || String(raw.nearEd25519SigningKeyId) !== requestResult.value.nearEd25519SigningKeyId || String(raw.signingWorkerId) !== requestResult.value.signingWorkerId || !thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || participantIds.length !== 2 || !Number.isSafeInteger(participantIds[0]) || !Number.isSafeInteger(participantIds[1]) || String(walletSessionId.value) !== String(args.operationCredential.walletSessionId) || String(thresholdSessionId.value) !== requestResult.value.thresholdSessionId) throw new Error("[login] linked Ed25519 post-link bootstrap identity is invalid");
-	const expiresAtMs = Number(raw.thresholdExpiresAtMs);
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("[login] linked Ed25519 post-link bootstrap is expired");
-	return {
-		walletId: String(args.selection.walletId),
-		nearAccountId: requestResult.value.nearAccountId,
-		nearEd25519SigningKeyId: requestResult.value.nearEd25519SigningKeyId,
-		relayerKeyId: requestResult.value.signingWorkerId,
-		participantIds: [participantIds[0], participantIds[1]],
-		thresholdSessionId: thresholdSessionId.value,
-		authorizationId: args.walletSession.authorizationId,
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value,
-		expiresAtMs,
-		remainingUses: DEFAULT_UNLOCK_REMAINING_USES,
-		runtimePolicyScope,
-		routerAbNormalSigning,
-		operationCredential: args.operationCredential
-	};
-}
-async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
-	const selection = await resolveLinkedDevicePostLinkSelection(args.factor);
-	assertLinkedDeviceWalletSessionExact(selection, args.walletSession);
-	const relayerUrl = String(args.context.configs.network.relayer?.url || "").trim();
-	if (!relayerUrl) throw new Error("[login] linked post-link activation requires relayer.url");
-	await walletSessionAuthorizations.writeExactWithOperationCredential({
-		record: args.walletSession,
-		operationCredential: args.operationCredential
-	});
-	const openedMaterials = await openLinkedDeviceSignerMaterialsWithFactorSecret({
-		selection,
-		factorSecret32: args.factorSecret32
-	});
-	try {
-		const providerIdentity = args.factor.kind === "email_otp" ? args.factor.providerIdentity : void 0;
-		const factorAuthority = await walletAuthAuthorityForLinkedDeviceMethod({
-			selection,
-			...providerIdentity ? { providerIdentity } : {}
-		});
-		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (ecdsaMaterial) {
-			const { runtime } = await activateLinkedDeviceEcdsaHolderRuntime({
-				context: args.context,
-				selection,
-				factorAuthority,
-				material: ecdsaMaterial
-			});
-			scheduleLinkedDevicePresignaturePrefill({
-				runtime,
-				operationCredential: args.operationCredential,
-				expiresAtMs: args.walletSession.expiresAtMs,
-				relayerUrl,
-				workerCtx: args.context.signingEngine.getSignerWorkerContext()
-			});
-		}
-		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
-		if (ed25519Material) {
-			const session = await linkedDeviceEd25519SessionAfterLink({
-				relayerUrl,
-				selection,
-				walletSession: args.walletSession,
-				operationCredential: args.operationCredential,
-				material: ed25519Material
-			});
-			await activateLinkedDeviceEd25519Runtime({
-				context: args.context,
-				selection,
-				session,
-				material: ed25519Material,
-				relayerUrl,
-				...providerIdentity ? { providerIdentity } : {}
-			});
-		}
-		if (selection.exportRoot) {
-			if (args.factor.kind === "passkey") await args.context.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({
-				existingEnvelope: selection.exportRoot.envelope,
-				passkeyPrfFirstB64u: base64UrlEncode(args.factorSecret32),
-				walletId: String(selection.walletId),
-				walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-				walletSessionId: String(args.operationCredential.walletSessionId),
-				expiresAtMs: args.walletSession.expiresAtMs
-			});
-			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding) || selection.exportRoot.envelope.binding.kind === "ed25519_yao_client_root_v1") await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
-				existingEnvelope: selection.exportRoot.envelope,
-				existingFactorSecret: args.factorSecret32,
-				walletId: String(selection.walletId),
-				walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-				walletSessionId: String(args.operationCredential.walletSessionId),
-				expiresAtMs: args.walletSession.expiresAtMs
-			});
-		}
-		await args.context.signingEngine.markWalletSelectionUnlocked({
-			walletId: selection.walletId,
-			walletAuthMethodId: selection.authMethod.walletAuthMethodId
-		});
-	} finally {
-		for (const openedMaterial of openedMaterials) openedMaterial.material.fill(0);
-	}
-}
-function linkedDeviceEd25519Metadata(material) {
-	const binding = material.publicFacts.targetBinding;
-	const receipt = material.publicFacts.activationReceipt;
-	return {
-		kind: ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1,
-		scope: {
-			lifecycle_id: binding.lifecycle.lifecycle_id,
-			root_share_epoch: binding.lifecycle.root_share_epoch,
-			account_id: binding.lifecycle.account_id,
-			threshold_session_id: binding.lifecycle.session_id,
-			signer_set_id: binding.lifecycle.signer_set_id,
-			signing_worker_id: binding.lifecycle.selected_server_id,
-			material_activation: binding.material_activation
-		},
-		applicationBinding: material.publicFacts.applicationBinding,
-		participantIds: material.publicFacts.participantIds,
-		registeredPublicKey: Uint8Array.from(receipt.registered_public_key),
-		signingWorkerVerifyingShare: Uint8Array.from(receipt.signing_worker_verifying_share),
-		stateEpoch: BigInt(receipt.state_epoch),
-		transcript: Uint8Array.from(receipt.transcript),
-		activeCapabilityBinding: binding.session_id,
-		materialActivation: material.materialActivation
-	};
-}
-function linkedDeviceEmailOtpProviderSubjectId(providerIdentity) {
-	const providerSubjectId = String(providerIdentity?.providerSubjectId || "").trim();
-	if (!providerSubjectId) throw new Error("[login] linked Email OTP lane provider identity is missing");
-	return providerSubjectId;
-}
-function linkedDeviceEd25519SessionFromEmailOtpBootstrap(args) {
-	const session = args.session;
-	if (session.authorityScope.kind !== "email_otp" || String(session.authorityScope.providerUserId) !== String(args.providerIdentity.providerSubjectId)) {
-		const mismatches = [...session.authorityScope.kind !== "email_otp" ? ["scope.kind"] : [], ...session.authorityScope.kind === "email_otp" && String(session.authorityScope.providerUserId) !== String(args.providerIdentity.providerSubjectId) ? ["scope.providerUserId"] : []];
-		throw new Error(`[login] linked Email OTP Ed25519 session authority mismatch: ${mismatches.join(", ")}`);
-	}
-	const thresholdSessionId = parseThresholdEd25519SessionId(session.thresholdSessionId);
-	const authorizationId = parseWalletSessionAuthorizationId(session.authorizationId);
-	const walletSessionId = parseWalletSessionId(session.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(session.quotaId);
-	if (!thresholdSessionId.ok || !authorizationId.ok || !walletSessionId.ok || !quotaId.ok) throw new Error("[login] linked Email OTP Ed25519 session identity is invalid");
-	if (args.operationCredential.walletSessionId !== walletSessionId.value) throw new Error("[login] linked Email OTP Ed25519 credential identifies another session");
-	return {
-		walletId: String(session.walletId),
-		nearAccountId: session.nearAccountId,
-		nearEd25519SigningKeyId: session.nearEd25519SigningKeyId,
-		relayerKeyId: session.routerAbNormalSigning.signingWorkerId,
-		participantIds: session.participantIds,
-		thresholdSessionId: thresholdSessionId.value,
-		authorizationId: authorizationId.value,
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value,
-		expiresAtMs: session.expiresAtMs,
-		remainingUses: session.remainingUses,
-		runtimePolicyScope: session.runtimePolicyScope,
-		routerAbNormalSigning: session.routerAbNormalSigning,
-		operationCredential: args.operationCredential
-	};
-}
-function linkedDeviceEd25519YaoLaneReference(args) {
-	const nearAccountId = toAccountId(args.session.nearAccountId);
-	const common = {
-		walletId: args.selection.walletId,
-		nearAccountId,
-		thresholdSessionId: args.session.thresholdSessionId,
-		runtimePolicyScope: args.session.runtimePolicyScope,
-		materialActivation: args.material.materialActivation,
-		nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(args.session.nearEd25519SigningKeyId),
-		signerSlot: args.material.publicFacts.applicationBinding.key_creation_signer_slot
-	};
-	if (args.selection.authMethod.kind === "passkey") return {
-		...common,
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.selection.authMethod.rpId),
-			credentialIdB64u: args.selection.authMethod.credentialIdB64u
-		}
-	};
-	return {
-		...common,
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: linkedDeviceEmailOtpProviderSubjectId(args.providerIdentity)
-		},
-		remainingUses: args.session.remainingUses,
-		expiresAtMs: args.session.expiresAtMs
-	};
-}
-async function activateLinkedDeviceEd25519Runtime(args) {
-	const metadata = linkedDeviceEd25519Metadata(args.material);
-	const application = metadata.applicationBinding;
-	const mismatchLabels = [];
-	if (args.session.walletId !== String(args.selection.walletId)) mismatchLabels.push("walletId");
-	if (application.wallet_id !== String(args.selection.walletId)) mismatchLabels.push("application.walletId");
-	if (metadata.scope.account_id !== String(args.selection.walletId)) mismatchLabels.push("material.walletId");
-	if (args.session.nearEd25519SigningKeyId !== application.near_ed25519_signing_key_id) mismatchLabels.push("nearEd25519SigningKeyId");
-	if (args.session.thresholdSessionId !== metadata.scope.threshold_session_id) mismatchLabels.push("thresholdSessionId");
-	if (args.session.relayerKeyId !== metadata.scope.signing_worker_id) mismatchLabels.push("signingWorkerId");
-	if (mismatchLabels.length > 0) throw new Error(`[login] linked Ed25519 Wallet Session does not match local material: ${mismatchLabels.join(", ")}`);
-	const activeClient = (await RouterAbEd25519YaoClientV1.initializeBundled()).importLinkedMaterial({
-		ownedClientScalarShare: args.material.material,
-		publicReceipt: args.material.publicFacts.activationReceipt,
-		metadata
-	});
-	let activated = false;
-	try {
-		const activatedIdentity = await args.context.signingEngine.activateVerifiedNearEd25519YaoMaterial({
-			activeClient,
-			facts: {
-				thresholdSessionId: args.session.thresholdSessionId,
-				signer: nearEd25519SignerBindingFromBoundaryFields({
-					walletId: args.selection.walletId,
-					nearAccountId: toAccountId(args.session.nearAccountId),
-					nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(args.session.nearEd25519SigningKeyId),
-					signerSlot: application.key_creation_signer_slot
-				}),
-				signingRootId: application.signing_root_id,
-				signingRootVersion: metadata.scope.root_share_epoch,
-				routerAbNormalSigning: args.session.routerAbNormalSigning,
-				runtimePolicyScope: args.session.runtimePolicyScope,
-				relayerUrl: args.relayerUrl
-			}
-		});
-		const nearAccountId = toAccountId(args.session.nearAccountId);
-		if (String(activatedIdentity.walletId) !== String(args.selection.walletId) || String(activatedIdentity.nearAccountId) !== String(nearAccountId) || !mpcMaterialActivationRefsEqual(activatedIdentity.materialActivation, args.material.materialActivation)) throw new Error("[login] linked Ed25519 activation identity does not match the V2 session");
-		await publishEd25519YaoPublicCapabilityReferenceAndLane(new IndexedDbEd25519YaoPublicCapabilityReferenceStore(IndexedDBManager), linkedDeviceEd25519YaoLaneReference({
-			selection: args.selection,
-			session: args.session,
-			material: args.material,
-			...args.providerIdentity ? { providerIdentity: args.providerIdentity } : {}
-		}));
-		activated = true;
-	} finally {
-		if (!activated) activeClient.dispose();
-	}
-	const nearAccountId = toAccountId(args.session.nearAccountId);
-	return {
-		success: true,
-		kind: "near_wallet_unlocked",
-		walletId: args.selection.walletId,
-		loggedInNearAccountId: String(nearAccountId),
-		operationalPublicKey: `ed25519:${base58Encode(metadata.registeredPublicKey)}`,
-		nearAccountId
-	};
-}
-function emailOtpUnlockSource(selection) {
-	const [first, ...rest] = selection.signerMaterials;
-	if (selection.authority.provenance.kind === "device_link") {
-		if (!first) throw new Error("[login] linked Email OTP authority has no signer material");
-		return {
-			kind: "linked_device",
-			selection,
-			signerMaterials: [first, ...rest]
-		};
-	}
-	if (first) throw new Error("[login] owner Email OTP authority must not carry linked signer material");
-	return {
-		kind: "owner_authority",
-		selection
-	};
-}
-/**
-* What this unlock should build, decided by the branch rather than by whichever
-* fields happened to be present.
-*
-* A linked device names the signer slot its own sealed material carries. An
-* owner authority has none, so the request is assembled from its exact
-* authority projection and the runtime is built inside the unlock.
-*/
-async function emailOtpAuthorityUnlockEd25519Request(input) {
-	const { source } = input;
-	if (source.kind === "linked_device") {
-		const ed25519Material = source.signerMaterials.find((material) => material.kind === "wallet_authority_linked_signer_material_v1" && material.keyFamily === "ed25519");
-		if (!ed25519Material) return { kind: "no_ed25519" };
-		return {
-			kind: "linked_device",
-			signerSlot: ed25519Material.publicFacts.applicationBinding.key_creation_signer_slot,
-			remainingUses: DEFAULT_UNLOCK_REMAINING_USES
-		};
-	}
-	if (!source.selection.authority.signerActivations.ed25519 || await hasPendingJoinedNearRegistration(source.selection)) return { kind: "no_ed25519" };
-	return await input.context.signingEngine.resolveOwnerAuthorityEd25519UnlockRequestInternal({
-		walletSession: {
-			walletId: source.selection.walletId,
-			walletSessionUserId: String(source.selection.walletId)
-		},
-		providerSubjectId: input.providerIdentity.providerSubjectId,
-		walletAuthMethodId: String(source.selection.authMethod.walletAuthMethodId),
-		remainingUses: DEFAULT_UNLOCK_REMAINING_USES
-	}) ?? { kind: "no_ed25519" };
-}
-async function hasPendingJoinedNearRegistration(selection) {
-	const activation = selection.authority.signerActivations.ed25519?.materialActivation;
-	if (!activation) return false;
-	return (await IndexedDBManager.listPendingWalletRegistrationCommits()).some(pendingNearRegistrationMatchesAuthority.bind(void 0, selection, activation));
-}
-function pendingNearRegistrationMatchesAuthority(selection, activation, pending) {
-	return pending.operation === "near_provisioning" && pending.phase === "joined" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletId === selection.walletId && pending.walletAuthMethodId === selection.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(pending.localMaterial.ed25519.metadata.materialActivation, activation);
-}
-/**
-* Install the Ed25519 runtime an owner authority's unlock just built.
-*
-* Everything is checked against the authority and method that were selected,
-* before the handle is used: a session naming a different method, or a
-* capability naming a different activation, must not be able to activate a
-* runtime under this one.
-*/
-async function unlockOwnerAuthorityEmailOtpEd25519(input) {
-	const { selection, unlocked } = input;
-	const session = unlocked.walletSession;
-	if (session.walletId !== selection.walletId || session.authorityId !== selection.authority.authorityId || session.authMethodId !== selection.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selection.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selection.authority.revocationEpoch) throw new Error("[login] owner Email OTP Wallet Session does not match the selected authority");
-	const activation = selection.authority.signerActivations.ed25519?.materialActivation;
-	if (!activation) return;
-	if (unlocked.ed25519Activation.kind !== "ed25519_activation_ready") {
-		if (await hasPendingJoinedNearRegistration(selection)) return;
-		throw new Error("[login] owner Email OTP unlock built no Ed25519 runtime to install");
-	}
-	const ready = unlocked.ed25519Activation;
-	if (!mpcMaterialActivationRefsEqual(ready.bootstrap.capability.materialActivation, activation)) throw new Error("[login] owner Email OTP Ed25519 capability names another activation");
-	if (!mpcMaterialActivationRefsEqual(ready.metadata.materialActivation, activation)) throw new Error("[login] owner Email OTP Ed25519 runtime names another activation");
-	if (ready.bootstrap.session.walletSessionId !== unlocked.operationCredential.walletSessionId) throw new Error("[login] owner Email OTP Ed25519 session credential mismatch");
-	const authority = await walletAuthAuthorityRefForLinkedDeviceMethod({
-		selection,
-		providerIdentity: input.providerIdentity
-	});
-	await input.context.signingEngine.activateOwnerAuthorityEd25519RuntimeInternal({
-		walletSession: {
-			walletId: selection.walletId,
-			walletSessionUserId: String(selection.walletId)
-		},
-		providerSubjectId: input.providerIdentity.providerSubjectId,
-		walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-		emailHashHex: input.emailHashHex,
-		authority,
-		activeClientHandle: ready.activeClientHandle,
-		metadata: ready.metadata,
-		bootstrap: ready.bootstrap
-	});
-}
-function ownerAuthorityWalletCustodySeedEnvelope(unlocked) {
-	switch (unlocked.walletCustodySeed.kind) {
-		case "owner_authority_seed_envelope": return unlocked.walletCustodySeed.existingEnvelope;
-		case "linked_device_seed_unavailable": throw new Error("[login] owner Email OTP unlock returned linked-device custody state");
-		default: return assertNeverLoginState(unlocked.walletCustodySeed);
-	}
-}
-async function unlockLinkedDeviceEmailOtpWallet(args) {
-	const providerIdentity = {
-		provider: args.providerSubjectId.startsWith("google:") ? "google" : "email",
-		providerSubjectId: args.providerSubjectId
-	};
-	const resolution = await resolveLinkedDeviceEmailOtpAuthoritySelection({
-		walletIdInput: args.walletIdInput,
-		emailHashHex: args.emailHashHex,
-		provider: providerIdentity.provider,
-		providerSubjectId: providerIdentity.providerSubjectId,
-		walletAuthMethodId: args.walletAuthMethodId
-	});
-	if (resolution.kind === "none") throw new Error("[login] linked Email OTP authority is unavailable");
-	if (resolution.kind === "rejected") throw new Error(resolution.message);
-	const selection = resolution.selection;
-	if (String(selection.authMethod.walletAuthMethodId) !== String(args.walletAuthMethodId)) throw new Error("[login] linked Email OTP selected auth method changed during unlock");
-	const relayUrl = String(args.relayUrl || "").trim();
-	if (!relayUrl) throw new Error("[login] linked Email OTP unlock requires relayer.url");
-	const source = emailOtpUnlockSource(selection);
-	const ed25519Request = await emailOtpAuthorityUnlockEd25519Request({
-		context: args.context,
-		source,
-		providerIdentity
-	});
-	const unlocked = await unlockEmailOtpAuthorityWallet({
-		relayUrl,
-		walletId: String(selection.walletId),
-		walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-		challengeId: args.challengeId,
-		otpCode: args.otpCode,
-		ed25519: ed25519Request,
-		workerCtx: args.context.signingEngine.getSignerWorkerContext()
-	});
-	const factorSecret32 = unlocked.factorSecret32;
-	const effectiveProviderIdentity = providerIdentity;
-	let openedMaterials = null;
-	let installedEcdsaRuntime = null;
-	let ownedActiveClientHandle = unlocked.ed25519Activation.kind === "ed25519_activation_ready" ? unlocked.ed25519Activation.activeClientHandle : null;
-	try {
-		if (source.kind === "owner_authority") {
-			await walletSessionAuthorizations.writeExactWithOperationCredential({
-				record: unlocked.walletSession,
-				operationCredential: unlocked.operationCredential
-			});
-			await unlockOwnerAuthorityEmailOtpEd25519({
-				context: args.context,
-				selection,
-				unlocked,
-				providerIdentity: effectiveProviderIdentity,
-				emailHashHex: args.emailHashHex
-			});
-			ownedActiveClientHandle = null;
-			if (!factorSecret32) throw new Error("[login] owner Email OTP factor secret ownership was lost");
-			await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
-				existingEnvelope: ownerAuthorityWalletCustodySeedEnvelope(unlocked),
-				existingFactorSecret: factorSecret32,
-				walletId: String(selection.walletId),
-				walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-				walletSessionId: String(unlocked.operationCredential.walletSessionId),
-				expiresAtMs: unlocked.walletSession.expiresAtMs
-			});
-			await args.context.signingEngine.markWalletSelectionUnlocked({
-				walletId: selection.walletId,
-				walletAuthMethodId: selection.authMethod.walletAuthMethodId
-			});
-			args.context.signingEngine.setWalletAuthenticated({
-				kind: "authenticated",
-				walletId: selection.walletId,
-				authMethod: SIGNER_AUTH_METHODS.emailOtp
-			});
-			resumeNearAfterSuccessfulUnlock({
-				context: args.context,
-				sessionAuthority: {
-					record: unlocked.walletSession,
-					operationCredential: unlocked.operationCredential
-				},
-				factor: {
-					kind: "email_otp",
-					provider: providerIdentity.provider,
-					providerSubject: providerIdentity.providerSubjectId,
-					emailHashHex: args.emailHashHex
-				},
-				ownedFactorSecret: factorSecret32.slice().buffer,
-				custodyEnvelope: ownerAuthorityWalletCustodySeedEnvelope(unlocked)
-			});
-			return;
-		}
-		assertLinkedDeviceWalletSessionExact(selection, unlocked.walletSession);
-		if (!factorSecret32) throw new Error("[login] linked Email OTP factor secret ownership was lost");
-		openedMaterials = await openLinkedDeviceEmailOtpSignerMaterials({
-			selection,
-			factorSecret32
-		});
-		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
-		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (linkedDeviceRuntimeRequiresCurve(unlocked.walletSession, "ed25519")) {
-			if (!ed25519Material || !unlocked.ed25519Activation.bootstrap) throw new Error("[login] linked Email OTP Ed25519 runtime material or capability is missing");
-			if (!mpcMaterialActivationRefsEqual(unlocked.ed25519Activation.bootstrap.capability.materialActivation, ed25519Material.materialActivation)) throw new Error("[login] linked Email OTP Ed25519 capability activation is invalid");
-		}
-		if (linkedDeviceRuntimeRequiresCurve(unlocked.walletSession, "ecdsa")) {
-			if (!ecdsaMaterial) throw new Error("[login] linked Email OTP ECDSA runtime material is missing");
-			const activatedEcdsa = await activateLinkedDeviceEcdsaHolderRuntime({
-				context: args.context,
-				selection,
-				factorAuthority: await walletAuthAuthorityForLinkedDeviceMethod({
-					selection,
-					providerIdentity: effectiveProviderIdentity
-				}),
-				material: ecdsaMaterial
-			});
-			if (activatedEcdsa.installed) installedEcdsaRuntime = activatedEcdsa.runtime;
-		}
-		let loginResult;
-		if (ed25519Material && unlocked.ed25519Activation.bootstrap) {
-			const ed25519Session = linkedDeviceEd25519SessionFromEmailOtpBootstrap({
-				session: unlocked.ed25519Activation.bootstrap.session,
-				operationCredential: unlocked.operationCredential,
-				providerIdentity: effectiveProviderIdentity
-			});
-			if (ed25519Session.walletSessionId !== unlocked.operationCredential.walletSessionId) throw new Error("[login] linked Email OTP Ed25519 session credential mismatch");
-			loginResult = await activateLinkedDeviceEd25519Runtime({
-				context: args.context,
-				selection,
-				session: ed25519Session,
-				material: ed25519Material,
-				relayerUrl: relayUrl,
-				providerIdentity: effectiveProviderIdentity
-			});
-		} else if (ecdsaMaterial) loginResult = {
-			success: true,
-			kind: "ecdsa_wallet_unlocked",
-			walletId: selection.walletId
-		};
-		else throw new Error("[login] linked Email OTP has no unlockable signing runtime");
-		await walletSessionAuthorizations.writeExactWithOperationCredential({
-			record: unlocked.walletSession,
-			operationCredential: unlocked.operationCredential
-		});
-		if (selection.exportRoot && isWalletCustodySeedBinding(selection.exportRoot.envelope.binding)) await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
-			existingEnvelope: selection.exportRoot.envelope,
-			existingFactorSecret: factorSecret32,
-			walletId: String(selection.walletId),
-			walletAuthMethodId: String(selection.authMethod.walletAuthMethodId),
-			walletSessionId: String(unlocked.operationCredential.walletSessionId),
-			expiresAtMs: unlocked.walletSession.expiresAtMs
-		});
-		await args.context.signingEngine.markWalletSelectionUnlocked({
-			walletId: selection.walletId,
-			walletAuthMethodId: selection.authMethod.walletAuthMethodId
-		});
-		args.context.signingEngine.setWalletAuthenticated({
-			kind: "authenticated",
-			walletId: loginResult.walletId,
-			authMethod: SIGNER_AUTH_METHODS.emailOtp
-		});
-	} catch (error) {
-		if (installedEcdsaRuntime) {
-			removeLinkedEcdsaHolderRuntimeV1({
-				walletId: installedEcdsaRuntime.walletId,
-				materialActivation: installedEcdsaRuntime.materialActivation,
-				holderHandleId: installedEcdsaRuntime.holderHandleId
-			});
-			await destroyLinkedDeviceEcdsaHolderMaterialWasm({
-				holderHandleId: installedEcdsaRuntime.holderHandleId,
-				workerCtx: args.context.signingEngine.getSignerWorkerContext()
-			}).catch(() => void 0);
-		}
-		const workerContext = args.context.signingEngine.getSignerWorkerContext();
-		if (workerContext) await destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(walletCustodyCeremonyTransportFromWorkerContextV1(workerContext), {
-			kind: "wallet_session",
-			walletSessionId: String(unlocked.operationCredential.walletSessionId)
-		});
-		await Promise.allSettled([args.context.signingEngine.clearVolatileWarmSigningMaterial(selection.walletId), walletSessionAuthorizations.clearWallet(selection.walletId)]);
-		throw error;
-	} finally {
-		if (ownedActiveClientHandle) {
-			const workerContext = args.context.signingEngine.getSignerWorkerContext();
-			if (workerContext) await disposeWalletCustodyEd25519ActiveClientV1({
-				workerContext,
-				activeClientHandle: ownedActiveClientHandle
-			}).catch(() => void 0);
-			ownedActiveClientHandle = null;
-		}
-		for (const openedMaterial of openedMaterials || []) openedMaterial.material.fill(0);
-		factorSecret32?.fill(0);
-	}
-}
-async function unlockInternal(context, subjectSet, options, _completion) {
-	const { onEvent, onError, afterCall } = options || {};
-	const { signingEngine } = context;
-	const walletUnlockSelection = resolveLoginWalletUnlockSelectionForSubjectSet({
-		selection: options?.unlockSelection,
-		subjectSet
-	});
-	const walletIdentity = resolveLoginWalletIdentity({
-		subjectSet,
-		selection: walletUnlockSelection
-	});
-	const unlockSubjectId = walletIdentity.kind === "near_ed25519_capable_wallet" ? String(walletIdentity.nearAccountId) : String(walletIdentity.walletId);
-	let loginCredential;
-	emitUnlockEvent(onEvent, unlockSubjectId, {
-		phase: UnlockEventPhase.STEP_01_STARTED,
-		status: "started",
-		authMethod: "passkey"
-	});
-	try {
-		signingEngine.assertSealedRefreshStartupParity().catch((error) => {
-			console.warn("[login] sealed refresh startup parity check failed during unlock; continuing to local passkey prompt", error instanceof Error ? error.message : String(error || "unknown error"));
-		});
-		if (typeof window !== "undefined" && !window.isSecureContext) {
-			const errorMessage = "Passkey operations require a secure context (HTTPS or localhost).";
-			return await finalizeLoginError({
-				unlockSubjectId,
-				message: errorMessage,
-				error: new Error(errorMessage),
-				onEvent,
-				onError,
-				afterCall,
-				callAfterCall: false
-			});
-		}
-		const { accountSubject, authenticators, baseSignerSlot, localUnlockAuthMethod, requiresLocalPasskeyUnlock } = await readLoginUnlockAccountPhase({
-			signingEngine,
-			identity: walletIdentity,
-			signerSlotHint: parseSignerSlot(options?.signerSlot, { min: 1 }),
-			onEvent
-		});
-		const collectLocalPasskeyCredentialForChallenge = async (args) => {
-			const eligibleAuthenticators = authenticatorsForCredentialIds({
-				authenticators,
-				credentialIds: args.credentialIds
-			});
-			const credential = await collectPasskeyLoginAssertion({
-				signingEngine,
-				subjectId: unlockSubjectId,
-				challengeB64u: args.challengeB64u,
-				authenticators: eligibleAuthenticators,
-				onPromptStarted: () => {
-					emitUnlockEvent(onEvent, unlockSubjectId, {
-						phase: UnlockEventPhase.STEP_03_PASSKEY_PROMPT_STARTED,
-						status: "waiting_for_user",
-						authMethod: "passkey",
-						interaction: {
-							kind: "passkey_assert",
-							overlay: "show"
-						}
-					});
-				},
-				onPromptSucceeded: () => {
-					emitUnlockEvent(onEvent, unlockSubjectId, {
-						phase: UnlockEventPhase.STEP_03_PASSKEY_PROMPT_SUCCEEDED,
-						status: "succeeded",
-						authMethod: "passkey",
-						interaction: {
-							kind: "passkey_assert",
-							overlay: "hide"
-						}
-					});
-				}
-			});
-			if (args.saveAsLoginCredential) loginCredential = credential;
-			return credential;
-		};
-		const collectFreshLocalPasskeyUnlockCredentialForLogin = async () => {
-			const credential = await collectFreshLocalPasskeyUnlockCredential({
-				currentCredential: loginCredential,
-				collectCredentialForChallenge: async (challengeB64u) => await collectLocalPasskeyCredentialForChallenge({
-					challengeB64u,
-					saveAsLoginCredential: true,
-					credentialIds: resolveLoginPasskeyPromptCredentialIds({
-						authenticators,
-						signerSlot: baseSignerSlot,
-						serverCredentialIds: []
-					})
-				})
-			});
-			if (credential) loginCredential = credential;
-		};
-		const signingSessionPolicy = (() => {
-			const ttlMsRaw = options?.signingSession?.ttlMs ?? context.configs?.signing.sessionDefaults?.ttlMs;
-			const configuredRemainingUses = options?.signingSession?.remainingUses;
-			const defaultRemainingUses = context.configs?.signing.sessionDefaults?.remainingUses;
-			const requestedRemainingUses = configuredRemainingUses ?? defaultRemainingUses ?? DEFAULT_UNLOCK_REMAINING_USES;
-			const ttlMs = typeof ttlMsRaw === "number" ? Math.floor(ttlMsRaw) : Math.floor(Number(ttlMsRaw) || 0);
-			const unlockRemainingUses = resolveWalletUnlockSessionUsesFromRequestedUses({ requestedRemainingUses });
-			return {
-				ttlMs: Math.max(0, ttlMs),
-				unlockRemainingUses
-			};
-		})();
-		const requireThresholdWarmup = signingSessionPolicy.ttlMs > 0 && signingSessionPolicy.unlockRemainingUses != null;
-		const thresholdKeyMaterialPrefetch = requireThresholdWarmup && walletIdentity.kind === "near_ed25519_capable_wallet" ? getNearThresholdKeyMaterial({
-			clientDB: IndexedDBManager,
-			keyMaterialStore: IndexedDBManager
-		}, walletIdentity.nearAccountId, baseSignerSlot).catch(() => null) : Promise.resolve(null);
-		let completedPasskeyExchangeEcdsaActivation = null;
-		let completedPasskeyEd25519Session = null;
-		let completedPasskeyWalletSessionAuthorization = null;
-		let completedPasskeySessionCustody = null;
-		let localWarmupRouteAuthorization = resolveLoginWarmupRouteAuthorization();
-		let warmupPhase = null;
-		const requireActiveWarmSession = (source, sessionStatus) => {
-			if (isActiveThresholdLoginSigningSession(sessionStatus)) return sessionStatus;
-			const status = String(sessionStatus?.status || "not_found");
-			throw new Error(`[login] ${source} did not produce an active warm signing session (status=${status})`);
-		};
-		const warmThresholdSigningSessions = async (warmupInput) => {
-			emitUnlockEvent(onEvent, unlockSubjectId, {
-				phase: UnlockEventPhase.STEP_05_SIGNING_SESSION_WARMUP_STARTED,
-				status: "running",
-				authMethod: loginCredential ? "passkey" : "warm_session"
-			});
-			const nearWalletBinding = warmupInput.wantsEd25519Warmup ? requireNearLoginWalletBinding(walletIdentity) : null;
-			const managedRuntimeScopeBootstrap = resolveManagedRuntimeScopeBootstrap(context.configs);
-			let volatileWarmMaterialCleared = false;
-			const clearVolatileWarmMaterialForUnlock = async () => {
-				if (volatileWarmMaterialCleared) return;
-				volatileWarmMaterialCleared = true;
-				await signingEngine.clearVolatileWarmSigningMaterial(walletIdentity.walletId);
-			};
-			if (warmupInput.wantsEcdsaWarmup) reportNonSettledEcdsaActivationReconciliation(await reconcileCanonicalEcdsaActivationSelectors({
-				workerCtx: signingEngine.getSignerWorkerContext(),
-				selectors: ecdsaActivationSelectorsFromSubjectSet(walletIdentity.subjectSet)
-			}));
-			const storedCanonicalEcdsaContext = warmupInput.wantsEcdsaWarmup ? await resolveCanonicalThresholdEcdsaWarmSessionContext(context, walletIdentity.walletId, {
-				keyFactsInventoryAuthority: warmupInput.keyFactsInventoryAuthority,
-				keyFactsInventoryRequested: Boolean(options?.ecdsaKeyFactsInventory),
-				relayerUrl: warmupInput.relayerUrl,
-				rpId: warmupInput.rpId
-			}, localUnlockAuthMethod) : { ecdsaKeys: [] };
-			const thresholdKeyMaterial = await thresholdKeyMaterialPrefetch;
-			const participantIds = thresholdKeyMaterial?.participants.map((participant) => participant.id) || [];
-			if (warmupInput.wantsEcdsaWarmup) assertEcdsaWarmupMatchesUnlockSubjects({
-				identity: walletIdentity,
-				context: storedCanonicalEcdsaContext
-			});
-			const warmupPlan = resolveThresholdLoginWarmupPlan({
-				selection: warmupInput.selection,
-				selectedEcdsaTargets: warmupInput.selectedEcdsaTargets,
-				storedCanonicalEcdsaContext,
-				wantsEd25519Warmup: warmupInput.wantsEd25519Warmup
-			});
-			const passkeyExchangeEcdsaActivationForWarmup = completedPasskeyExchangeEcdsaActivation;
-			const passkeyExchangeOwnsFirstEcdsaActivation = Boolean(passkeyExchangeEcdsaActivationForWarmup && warmupPlan.signersToWarm.includes("ecdsa"));
-			const ed25519DependsOnEcdsa = passkeyExchangeOwnsFirstEcdsaActivation ? warmupPlan.signersToWarm.includes("ed25519") : warmupPlan.ed25519DependsOnEcdsa;
-			const ecdsaDependsOnEd25519 = passkeyExchangeOwnsFirstEcdsaActivation ? false : warmupPlan.ecdsaDependsOnEd25519;
-			const warmupPasskeyCredentialPlan = resolveLoginWarmupPasskeyCredentialPlan({
-				requiresLocalPasskeyUnlock,
-				hasLoginCredential: Boolean(loginCredential),
-				routeAuthorization: warmupInput.routeAuthorization,
-				warmupPlan
-			});
-			await clearVolatileWarmMaterialForUnlock();
-			const plannedEd25519SessionId = createThresholdLoginWarmSessionId("threshold-login");
-			let ed25519MintPlan = !warmupPlan.signersToWarm.includes("ed25519") ? { kind: "not_requested" } : ed25519DependsOnEcdsa ? {
-				kind: "ecdsa_authorized",
-				thresholdSessionId: plannedEd25519SessionId
-			} : { kind: "fresh" };
-			switch (warmupPasskeyCredentialPlan.kind) {
-				case "existing_passkey_credential":
-				case "no_passkey_credential_required": break;
-				case "wallet_custody":
-					if (warmupInput.ed25519SessionAuthority.kind !== "passkey") throw new Error("[login] wallet custody requires passkey wallet authority");
-					if (!completedPasskeySessionCustody || completedPasskeySessionCustody.ed25519.kind !== "active") throw createThresholdEd25519DeviceLinkRequiredError();
-					ed25519MintPlan = {
-						kind: "wallet_custody",
-						thresholdSessionId: plannedEd25519SessionId,
-						custody: {
-							...completedPasskeySessionCustody,
-							ed25519: completedPasskeySessionCustody.ed25519
-						}
-					};
-					break;
-				default: return assertNeverLoginState(warmupPasskeyCredentialPlan);
-			}
-			if (nearWalletBinding && !thresholdKeyMaterial && ed25519MintPlan.kind !== "wallet_custody") throw new Error(`[login] threshold warm-up requires threshold key material for ${nearWalletBinding.nearAccountId} signer slot ${warmupInput.signerSlot}`);
-			const authenticatedPasskeyCredentialIdB64u = loginCredential ? passkeyCredentialIdB64uFromAuthentication(loginCredential) : "";
-			const localPasskeyCredentialIdB64u = String(authenticatedPasskeyCredentialIdB64u || authenticators.find((authenticator) => authenticator.signerSlot === baseSignerSlot)?.credentialId || authenticators[0]?.credentialId || "").trim();
-			const credentialState = loginCredential ? {
-				kind: "available",
-				credential: loginCredential,
-				localPasskeyCredentialIdB64u
-			} : localPasskeyCredentialIdB64u ? {
-				kind: "credential_id_only",
-				localPasskeyCredentialIdB64u
-			} : {
-				kind: "unavailable",
-				localPasskeyCredentialIdB64u: ""
-			};
-			const runtimeScopeBootstrapState = managedRuntimeScopeBootstrap ? {
-				kind: "available",
-				runtimeScopeBootstrap: managedRuntimeScopeBootstrap
-			} : { kind: "unavailable" };
-			const warmupResult = await primeThresholdLoginWarmSigners({
-				statusReads,
-				context,
-				signingEngine,
-				walletIdentity,
-				signerSlot: warmupInput.signerSlot,
-				thresholdKeyMaterial,
-				relayerUrl: warmupInput.relayerUrl,
-				relayerKeyId: thresholdKeyMaterial?.relayerKeyId || "",
-				participantIds,
-				ttlMs: signingSessionPolicy.ttlMs,
-				unlockRemainingUses: requireLoginUnlockSessionUses(signingSessionPolicy.unlockRemainingUses),
-				ecdsaContext: warmupPlan.ecdsaContext,
-				credentialState,
-				runtimeScopeBootstrapState,
-				signersToWarm: warmupPlan.signersToWarm,
-				ed25519DependsOnEcdsa,
-				ecdsaDependency: ecdsaDependsOnEd25519 ? { kind: "ed25519_wallet_session_authority" } : { kind: "none" },
-				ed25519MintPlan,
-				ed25519SessionAuthority: warmupInput.ed25519SessionAuthority,
-				routeAuthorization: warmupInput.routeAuthorization,
-				passkeyExchangeEcdsaActivation: passkeyExchangeEcdsaActivationForWarmup,
-				passkeyUnlockEd25519Session: completedPasskeyEd25519Session,
-				passkeyUnlockWalletSessionAuthorization: completedPasskeyWalletSessionAuthorization
-			});
-			if (warmupPlan.signersToWarm.includes("ed25519")) {
-				const ed25519Session = warmupResult.ed25519Session;
-				if (!ed25519Session) throw new Error("[login] threshold warm-up omitted the Ed25519 session result");
-				const activeSigningSession = requireActiveWarmSession("threshold warm-up", createActiveLoginSigningSessionStatus({
-					session: ed25519Session,
-					authMethod: localUnlockAuthMethod
-				}));
-				emitUnlockEvent(onEvent, unlockSubjectId, {
-					phase: UnlockEventPhase.STEP_05_ED25519_SIGNING_SESSION_READY,
-					status: "succeeded",
-					authMethod: "warm_session"
-				});
-				if (warmupPlan.signersToWarm.includes("ecdsa")) emitUnlockEvent(onEvent, unlockSubjectId, {
-					phase: UnlockEventPhase.STEP_05_ECDSA_SIGNING_SESSION_READY,
-					status: "succeeded",
-					authMethod: "warm_session"
-				});
-				return {
-					kind: "threshold_login_warmup_ready",
-					signingSession: activeSigningSession,
-					signersWarmed: warmupPlan.signersToWarm
-				};
-			}
-			if (warmupPlan.signersToWarm.length !== 1 || warmupPlan.signersToWarm[0] !== "ecdsa") throw new Error("[login] threshold warm-up signer selection is invalid");
-			emitUnlockEvent(onEvent, unlockSubjectId, {
-				phase: UnlockEventPhase.STEP_05_ECDSA_SIGNING_SESSION_READY,
-				status: "succeeded",
-				authMethod: "warm_session"
-			});
-			return {
-				kind: "threshold_login_ecdsa_only_warmup_ready",
-				signersWarmed: ["ecdsa"]
-			};
-		};
-		const persistSuccessfulLoginState = async (signerSlot) => {
-			await signingEngine.setLastUser(walletIdentity.walletId, signerSlot);
-			if (walletIdentity.kind === "near_ed25519_capable_wallet") {
-				if (!(accountSubject.kind === "near_wallet" && accountSubject.operationalPublicKey === null)) await signingEngine.activateAuthenticatedWalletState({
-					walletId: walletIdentity.walletId,
-					nearAccountId: toAccountId(walletIdentity.nearAccountId),
-					signerSlot,
-					nearClient: context.nearClient
-				});
-			}
-		};
-		const recoverNonceLanesAfterUnlock = async () => {
-			await signingEngine.getNonceCoordinator().recoverDurableLeases({ walletId: walletIdentity.walletId }).catch((error) => {
-				console.warn("[login] nonce lane durable recovery after unlock failed", error);
-			});
-		};
-		const noServerSessionPasskeyCredentialPlan = resolveLoginNoServerSessionPasskeyCredentialPlan({
-			requiresLocalPasskeyUnlock,
-			requireThresholdWarmup,
-			hasLoginCredential: Boolean(loginCredential)
-		});
-		switch (noServerSessionPasskeyCredentialPlan.kind) {
-			case "wallet_unlock_owns_passkey_credential":
-			case "passkey_credential_already_collected":
-			case "no_local_passkey_required": break;
-			case "local_unlock_passkey_assertion":
-				await collectFreshLocalPasskeyUnlockCredentialForLogin();
-				break;
-			default: return assertNeverLoginState(noServerSessionPasskeyCredentialPlan);
-		}
-		const statusReads = new WalletSessionStatusReadScope();
-		if (requireThresholdWarmup && localUnlockAuthMethod === SIGNER_AUTH_METHODS.passkey) {
-			const preparedActivation = await preparePasskeyExchangeEcdsaActivation({
-				context,
-				walletIdentity,
-				selection: walletUnlockSelection,
-				ttlMs: signingSessionPolicy.ttlMs,
-				remainingUses: requireLoginUnlockSessionUses(signingSessionPolicy.unlockRemainingUses)
-			});
-			const relayUrl = String(context.configs.network.relayer.url || "").trim();
-			const rpId = String(signingEngine.getRpId() || "").trim();
-			if (!relayUrl || !rpId) throw new Error("[login] passkey wallet unlock requires relayer URL and rpId");
-			const completedUnlock = await completePasskeyWalletUnlock({
-				context,
-				walletIdentity,
-				unlockSubjectId,
-				onEvent,
-				authenticators,
-				signerSlot: baseSignerSlot,
-				remainingUses: requireLoginUnlockSessionUses(signingSessionPolicy.unlockRemainingUses),
-				relayUrl,
-				rpId,
-				expectedOrigin: void 0,
-				activation: preparedActivation,
-				collectCredentialForChallenge: async (challenge) => await collectLocalPasskeyCredentialForChallenge({
-					challengeB64u: challenge.challengeB64u,
-					saveAsLoginCredential: true,
-					credentialIds: challenge.credentialIds
-				})
-			}, statusReads);
-			loginCredential = completedUnlock.credential;
-			completedPasskeyExchangeEcdsaActivation = completedUnlock.activation;
-			completedPasskeyEd25519Session = completedUnlock.result.ed25519Session;
-			completedPasskeyWalletSessionAuthorization = completedUnlock.result.walletSessionAuthorization ?? (completedUnlock.activation ? exactAuthorizationFromPasskeyEcdsaActivation(completedUnlock.activation.sessionActivation) : null);
-			completedPasskeySessionCustody = completedUnlock.custody;
-			await rememberPasskeySessionCustodyForExport({
-				walletId: String(walletIdentity.walletId),
-				unlock: completedUnlock
-			});
-			localWarmupRouteAuthorization = resolveLoginWarmupRouteAuthorization();
-		}
-		if (!loginCredential) throw new Error("[login] successful Passkey unlock omitted its credential");
-		await markPasskeyLoginSelectionUnlocked({
-			context,
-			walletIdentity,
-			credential: loginCredential
-		});
-		if (requireThresholdWarmup) {
-			const authMethodBinding = await readThresholdWarmupAuthMethodBinding({
-				walletId: walletIdentity.walletId,
-				authMethod: localUnlockAuthMethod
-			});
-			const keyFactsInventoryAuthority = resolveUnlockEcdsaKeyFactsInventoryAuthority({
-				completedActivation: completedPasskeyExchangeEcdsaActivation,
-				request: options?.ecdsaKeyFactsInventory,
-				routeAuthorization: localWarmupRouteAuthorization,
-				wantsEcdsaWarmup: resolveLoginUnlockWarmupBranchPlan({
-					subjectSet: walletIdentity.subjectSet,
-					selection: walletUnlockSelection,
-					hasConfiguredEcdsaTargets: listConfiguredThresholdEcdsaPublicationTargets(context.configs.network.chains).length > 0
-				}).wantsEcdsaWarmup
-			});
-			warmupPhase = await warmThresholdSigningSessions(resolveThresholdLoginWarmupPhaseInput({
-				context,
-				signerSlot: baseSignerSlot,
-				authenticators,
-				selection: walletUnlockSelection,
-				subjectSet: walletIdentity.subjectSet,
-				authMethod: localUnlockAuthMethod,
-				authMethodBinding,
-				keyFactsInventoryAuthority,
-				routeAuthorization: localWarmupRouteAuthorization
-			}));
-			if (localUnlockAuthMethod === SIGNER_AUTH_METHODS.passkey) {
-				const authenticatedCredential = loginCredential;
-				if (!authenticatedCredential) throw new Error("[login] passkey threshold warm-up completed without a credential");
-				await assertPasskeyUnlockRuntimePostconditions({
-					context,
-					statusReads,
-					walletIdentity,
-					signersWarmed: warmupPhase.signersWarmed,
-					credential: authenticatedCredential
-				});
-			}
-		}
-		await persistSuccessfulLoginState(baseSignerSlot);
-		recoverNonceLanesAfterUnlock();
-		if (completedPasskeyWalletSessionAuthorization && loginCredential && completedPasskeySessionCustody) {
-			const prfFirstB64u = passkeyPrfFirstB64uFromCredential(loginCredential);
-			if (prfFirstB64u) resumeNearAfterSuccessfulUnlock({
-				context,
-				sessionAuthority: completedPasskeyWalletSessionAuthorization,
-				factor: {
-					kind: "passkey",
-					rpId: signingEngine.getRpId(),
-					credentialIdB64u: passkeyCredentialIdB64uFromAuthentication(loginCredential),
-					prfFirstB64u
-				},
-				ownedFactorSecret: base64UrlDecode(prfFirstB64u).slice().buffer,
-				custodyEnvelope: completedPasskeySessionCustody.envelope
-			});
-		}
-		const baseLoginResult = buildSuccessfulLoginResult({
-			identity: walletIdentity,
-			accountSubject
-		});
-		const loginResult = warmupPhase ? {
-			...baseLoginResult,
-			...warmupPhase.kind === "threshold_login_warmup_ready" ? { signingSession: warmupPhase.signingSession } : {}
-		} : baseLoginResult;
-		emitUnlockEvent(onEvent, unlockSubjectId, {
-			phase: UnlockEventPhase.STEP_06_SESSION_READY,
-			status: "succeeded",
-			authMethod: loginCredential ? "passkey" : void 0
-		});
-		return await finalizeLoginSuccess({
-			context,
-			authMethod: localUnlockAuthMethod,
-			unlockSubjectId,
-			loginResult,
-			onEvent,
-			afterCall
-		});
-	} catch (err) {
-		console.warn("[login] unlock failed before active session commit", {
-			unlockSubjectId,
-			message: err && typeof err === "object" && "message" in err ? String(err.message || "") : String(err || "")
-		});
-		await clearFailedUnlockSessionState({
-			context,
-			walletId: walletIdentity.walletId
-		});
-		return await finalizeLoginError({
-			unlockSubjectId,
-			message: getUserFriendlyErrorMessage(err, "login") || "Login failed",
-			error: err,
-			cancelled: isUserCancellationError(err),
-			onEvent,
-			onError,
-			afterCall
-		});
-	}
-}
-async function clearFailedUnlockSessionState(args) {
-	await IndexedDBManager.clearLastProfileSelection().catch(() => void 0);
-	try {
-		args.context.signingEngine.getNonceCoordinator().clearAll();
-	} catch {}
-	try {
-		await args.context.signingEngine.clearVolatileWarmSigningMaterial(args.walletId);
-	} catch {}
-}
-async function finalizeLoginSuccess(args) {
-	const { context, authMethod, unlockSubjectId, loginResult, onEvent, afterCall } = args;
-	if (loginResult.success) context.signingEngine.setWalletAuthenticated({
-		kind: "authenticated",
-		walletId: loginResult.walletId,
-		authMethod
-	});
-	emitUnlockEvent(onEvent, unlockSubjectId, {
-		phase: UnlockEventPhase.STEP_07_COMPLETED,
-		status: "succeeded",
-		data: { ...loginResult.success && loginResult.kind === "near_wallet_unlocked" ? { operationalPublicKey: loginResult.operationalPublicKey ?? "" } : { walletId: loginResult.success ? String(loginResult.walletId) : "" } }
-	});
-	await afterCall?.(true, loginResult);
-	return loginResult;
-}
-async function finalizeLoginError(args) {
-	const { message, unlockSubjectId, error, onEvent, onError, afterCall, callOnError = true, callAfterCall = true, cancelled = false } = args;
-	if (callOnError) onError?.(toError(error));
-	emitUnlockEvent(onEvent, unlockSubjectId, {
-		phase: cancelled ? UnlockEventPhase.CANCELLED : UnlockEventPhase.FAILED,
-		status: cancelled ? "cancelled" : "failed",
-		...cancelled ? {} : { message },
-		interaction: {
-			kind: "passkey_assert",
-			overlay: "hide"
-		},
-		error: { message }
-	});
-	if (callAfterCall) await afterCall?.(false);
-	return {
-		success: false,
-		error: message
-	};
-}
-function thresholdSessionIdFromPasskeyEcdsaActivation(activation) {
-	return isEcdsaCredentialFreeSessionActivationAuthorization(activation) ? activation.activation.session.threshold_session_id : activation.session.threshold_session_id;
-}
-function exactAuthorizationFromPasskeyEcdsaActivation(activation) {
-	if (isEcdsaCredentialFreeSessionActivationAuthorization(activation)) return activation.authorization;
-	return {
-		record: activation.session.wallet_session,
-		operationCredential: activation.session.operation_credential
-	};
-}
-function resolveUnlockEcdsaKeyFactsInventoryAuthority(args) {
-	if (!args.wantsEcdsaWarmup) return null;
-	if (args.completedActivation) {
-		let operationCredential;
-		try {
-			const sessionActivation = args.completedActivation.sessionActivation;
-			if (isEcdsaCredentialFreeSessionActivationAuthorization(sessionActivation)) operationCredential = parseWalletSessionOperationCredentialV1(sessionActivation.authorization.operationCredential);
-			else {
-				const response = args.completedActivation.response;
-				if (response.kind !== "router_ab_ecdsa_post_registration_session_activated_v1") throw new Error("completed ECDSA unlock activation branch is invalid");
-				operationCredential = parseWalletSessionOperationCredentialV1(response.session.operation_credential);
-			}
-		} catch {
-			throw new Error("[login] completed ECDSA unlock omitted a valid Wallet Session operation credential");
-		}
-		return {
-			kind: "wallet_session_operation_credential_v1",
-			operationCredential
-		};
-	}
-	const authority = resolveLoginEcdsaKeyFactsInventoryAuthority({
-		request: args.request ?? null,
-		routeAuthorization: args.routeAuthorization
-	});
-	if (authority?.kind === "webauthn") throw new Error("[login] ECDSA warm-up requires the Wallet Session minted by the unlock assertion");
-	return authority;
-}
-function assertPasskeyEcdsaExchangeContinuity(args) {
-	const signer = args.continuity.signers.find((candidate) => thresholdEcdsaChainTargetKey(candidate.chainTarget) === args.prepared.targetKey);
-	if (!signer) throw new Error("Passkey ECDSA custody continuity omitted the requested chain target");
-	const capability = signer.walletKey.publicCapability;
-	const receipt = signer.activationReceipt;
-	const activation = receipt.ecdsa_activation;
-	const normalScope = args.response.normal_signing.scope;
-	if (signer.walletKey.walletId !== args.walletId || signer.walletKey.keyHandle !== args.prepared.policy.key_handle || args.response.session.threshold_session_id !== args.prepared.policy.session_policy.threshold_session_id || !sameThresholdRuntimePolicyScope(signer.runtimePolicyScope, args.prepared.policy.session_policy.runtime_policy_scope) || !sameRouterAbEcdsaDerivationPublicCapabilityV1(args.response.public_capability, capability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(args.activationReceipt, receipt) || capability.context.application_binding_digest_b64u !== activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(capability.public_identity, activation.public_identity) || !sameRouterAbMpcMaterialActivationRef(capability.material_activation, activation.material_activation) || !sameRouterAbServerIdentityV1(capability.signer_set.selected_server, activation.signing_worker) || capability.activation_epoch !== activation.activation_epoch || normalScope.context.application_binding_digest_b64u !== activation.context.application_binding_digest_b64u || !sameRouterAbEcdsaDerivationPublicIdentityV1(normalScope.public_identity, activation.public_identity) || !sameRouterAbMpcMaterialActivationRef(normalScope.material_activation, activation.material_activation) || !sameRouterAbServerIdentityV1(normalScope.signing_worker, activation.signing_worker) || normalScope.activation_epoch !== activation.activation_epoch || normalScope.wallet_id !== args.walletId || normalScope.ecdsa_threshold_key_id !== signer.walletKey.ecdsaThresholdKeyId || normalScope.signing_root_id !== signer.walletKey.signingRootId || normalScope.signing_root_version !== signer.walletKey.signingRootVersion) throw new Error("Passkey ECDSA session activation changed custody continuity");
-}
-function assertRejoinedPasskeyEcdsaPublicFacts(args) {
-	const identity = args.signer.walletKey.publicCapability.public_identity;
-	if (args.publicFacts.contextBinding32B64u !== identity.context_binding_b64u || args.publicFacts.derivationClientSharePublicKey33B64u !== identity.derivation_client_share_public_key33_b64u || args.publicFacts.relayerPublicKey33B64u !== identity.server_public_key33_b64u || args.publicFacts.groupPublicKey33B64u !== identity.threshold_public_key33_b64u || args.publicFacts.ethereumAddress !== ethereumAddressFromEcdsaIdentityB64u(identity.ethereum_address20_b64u) || args.publicFacts.clientShareRetryCounter !== identity.client_share_retry_counter || args.publicFacts.relayerShareRetryCounter !== identity.server_share_retry_counter) throw new Error("Passkey ECDSA custody rejoin changed registered public identity");
-}
-async function rememberPasskeySessionCustodyForExport(args) {
-	const credentialIdB64u = String(args.unlock.credential.rawId || args.unlock.credential.id || "").trim();
-	if (!credentialIdB64u) throw new Error("[login] passkey assertion credential id is missing");
-	await rememberPasskeyCustodySessionEnvelope({
-		walletId: args.walletId,
-		credentialIdB64u,
-		envelope: args.unlock.custody.envelope
-	});
-}
-async function preparePasskeyExchangeEcdsaActivation(args) {
-	const configuredTargets = listConfiguredThresholdEcdsaPublicationTargets(args.context.configs.network.chains);
-	if (!resolveLoginUnlockWarmupBranchPlan({
-		subjectSet: args.walletIdentity.subjectSet,
-		selection: args.selection,
-		hasConfiguredEcdsaTargets: configuredTargets.length > 0
-	}).wantsEcdsaWarmup) return null;
-	const target = configuredTargets[0];
-	if (!target) return null;
-	const context = await resolveCanonicalThresholdEcdsaWarmSessionContext(args.context, args.walletIdentity.walletId, void 0, "passkey");
-	const targetKey = thresholdEcdsaChainTargetKey(target.chainTarget);
-	const targetEcdsaKey = context.ecdsaKeys.find((candidate) => candidate.targetKey === targetKey);
-	if (!targetEcdsaKey) throw createThresholdEcdsaDeviceLinkRequiredError(targetKey);
-	const runtimePolicyScope = context.runtimePolicyScope;
-	if (!runtimePolicyScope) throw new Error("[login] passkey ECDSA activation requires runtime policy scope");
-	const thresholdSessionId = requireThresholdLoginEcdsaSessionId(createThresholdLoginWarmSessionId("threshold-ecdsa-login"));
-	const walletSessionMintId = requireThresholdLoginWalletSessionMintId(createThresholdLoginWarmSessionId("wallet-session-mint"));
-	return {
-		targetKey,
-		requiresCustodyRejoin: !targetEcdsaKey.existingRoleLocalMaterial,
-		policy: {
-			kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-			key_handle: targetEcdsaKey.keyHandle,
-			session_policy: {
-				threshold_session_id: thresholdSessionId,
-				wallet_session_mint_id: walletSessionMintId,
-				ttl_ms: args.ttlMs,
-				remaining_uses: args.remainingUses,
-				runtime_policy_scope: runtimePolicyScope
-			}
-		}
-	};
-}
-function passkeyUnlockEd25519SessionRequest(args) {
-	switch (args.walletIdentity.kind) {
-		case "near_ed25519_capable_wallet": return {
-			kind: "requested",
-			remainingUses: args.remainingUses
-		};
-		case "evm_family_ecdsa_only_wallet": return { kind: "not_requested" };
-		default: return assertNeverLoginState(args.walletIdentity);
-	}
-}
-function passkeyWalletUnlockInput(args) {
-	if (args.activation) return {
-		type: "passkey_assertion",
-		challengeId: args.challengeId,
-		walletId: String(args.walletIdentity.walletId),
-		webauthn_authentication: args.credential,
-		ed25519SessionRequest: args.ed25519SessionRequest,
-		expected_origin: args.expectedOrigin,
-		ecdsaSessionPolicy: args.activation.policy
-	};
-	return {
-		type: "passkey_assertion",
-		challengeId: args.challengeId,
-		webauthn_authentication: args.credential,
-		ed25519SessionRequest: args.ed25519SessionRequest,
-		expected_origin: args.expectedOrigin
-	};
-}
-async function resolveActivePasskeyWalletSessionAuthority(args) {
-	const authMethod = await IndexedDBManager.getWalletAuthMethodV2(args.authorization.record.authMethodId);
-	if (!authMethod || authMethod.kind !== "passkey" || authMethod.status !== "active" || authMethod.walletId !== args.walletId || authMethod.walletAuthorityId !== args.authorization.record.authorityId) throw new Error("Passkey Wallet Session authorization changed auth-method identity");
-	const authority = await IndexedDBManager.getWalletAuthority(authMethod.walletAuthorityId);
-	if (!authority || authority.state !== "active" || authority.walletId !== args.walletId || authority.authorityId !== args.authorization.record.authorityId || authority.authorityDigestB64u !== args.authorization.record.authorityDigestB64u || authority.revocationEpoch !== args.authorization.record.authorityRevocationEpoch) throw new Error("Passkey Wallet Session authorization changed authority identity");
-	return {
-		reference: await walletAuthAuthorityRefForSelectedPasskeyMethod(authMethod),
-		identity: exactWalletSessionAuthorityIdentity({
-			authority,
-			walletAuthMethodId: authMethod.walletAuthMethodId
-		})
-	};
-}
-async function validatePasskeyWalletSessionAuthorization(args) {
-	const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(args.credential);
-	if (!credentialIdB64u) throw new Error("Passkey Wallet Session adoption requires WebAuthn credential identity");
-	const authMethod = await exactPasskeyWalletAuthMethodForCredential({
-		walletId: args.walletIdentity.walletId,
-		rpId: args.rpId,
-		credentialIdB64u
-	});
-	const authority = await resolveActivePasskeyWalletSessionAuthority({
-		walletId: args.walletIdentity.walletId,
-		authorization: args.authorization
-	});
-	if (args.authorization.record.walletId !== args.walletIdentity.walletId || args.authorization.record.authMethodId !== authMethod.walletAuthMethodId || args.authorization.record.authorityId !== authMethod.walletAuthorityId || authority.reference.walletId !== args.walletIdentity.walletId) throw new Error("Passkey Wallet Session authorization changed auth-method identity");
-	return authority;
-}
-function bindPasskeyEcdsaSessionPolicyToUnlockChallenge(policy, challengeId) {
-	return {
-		...policy,
-		session_policy: {
-			...policy.session_policy,
-			wallet_session_mint_id: requireThresholdLoginWalletSessionMintId(challengeId)
-		}
-	};
-}
-async function completePasskeyWalletUnlock(args, statusReads) {
-	emitUnlockEvent(args.onEvent, args.unlockSubjectId, {
-		phase: UnlockEventPhase.STEP_03_PASSKEY_CHALLENGE_STARTED,
-		status: "running",
-		authMethod: "passkey"
-	});
-	const challengeResponse = await fetch(joinNormalizedUrl(args.relayUrl, "/wallet/unlock/challenge"), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			unlockBackend: "passkey",
-			userId: String(args.walletIdentity.walletId),
-			rpId: args.rpId
-		})
-	});
-	const challengeBodyUnknown = await challengeResponse.json().catch(() => ({}));
-	const challengeBody = isObject(challengeBodyUnknown) ? challengeBodyUnknown : {};
-	const challengeMessage = typeof challengeBody.message === "string" ? challengeBody.message : "";
-	if (!challengeResponse.ok || challengeBody.ok !== true) throw new Error(challengeMessage || `wallet/unlock/challenge failed (HTTP ${challengeResponse.status})`);
-	const challengeId = String(challengeBody.challengeId || "").trim();
-	const challengeB64u = String(challengeBody.challengeB64u || "").trim();
-	if (!challengeId || !challengeB64u) throw new Error("wallet/unlock/challenge returned invalid challenge");
-	const activation = args.activation ? {
-		...args.activation,
-		policy: bindPasskeyEcdsaSessionPolicyToUnlockChallenge(args.activation.policy, challengeId)
-	} : null;
-	const credentialIds = resolveLoginPasskeyPromptCredentialIds({
-		authenticators: args.authenticators,
-		signerSlot: args.signerSlot,
-		serverCredentialIds: parseLoginChallengeCredentialIds(challengeBody.credentialIds)
-	});
-	const credential = await args.collectCredentialForChallenge({
-		challengeB64u,
-		credentialIds
-	});
-	const expectedOrigin = String(args.expectedOrigin ?? (typeof window !== "undefined" ? window.location.origin : "")).trim();
-	if (!expectedOrigin) throw new Error("[login] passkey wallet unlock requires an expected origin");
-	const unlockInput = passkeyWalletUnlockInput({
-		challengeId,
-		credential,
-		ed25519SessionRequest: passkeyUnlockEd25519SessionRequest({
-			walletIdentity: args.walletIdentity,
-			remainingUses: args.remainingUses
-		}),
-		expectedOrigin,
-		walletIdentity: args.walletIdentity,
-		activation
-	});
-	const result = await verifyPasskeyWalletUnlock(args.relayUrl, unlockInput, statusReads);
-	if (!result.success) throw new Error(result.error || "Passkey wallet unlock failed");
-	if (!result.walletCustody) throw new Error("Passkey wallet unlock omitted wallet custody continuity");
-	if (activation && (!result.ecdsaSession || !result.ecdsaActivationReceipt || !result.ecdsaCustody)) throw new Error("Passkey wallet unlock omitted the requested ECDSA activation");
-	const walletSessionAuthorizationToPersist = result.walletSessionAuthorization ?? null;
-	const passkeySessionAuthority = walletSessionAuthorizationToPersist ? await validatePasskeyWalletSessionAuthorization({
-		walletIdentity: args.walletIdentity,
-		rpId: args.rpId,
-		credential,
-		authorization: walletSessionAuthorizationToPersist
-	}) : null;
-	let sessionActivation = null;
-	if (activation && result.ecdsaSession && result.ecdsaActivationReceipt && result.ecdsaCustody && result.ecdsaSession.kind === "router_ab_ecdsa_credential_free_session_activated_v1") {
-		const walletSessionAuthorization = result.walletSessionAuthorization;
-		if (!walletSessionAuthorization) throw new Error("Passkey credential-free activation omitted exact Wallet Session authority");
-		if (!passkeySessionAuthority) throw new Error("Passkey credential-free activation omitted exact Passkey authority");
-		sessionActivation = {
-			kind: "credential_free_ecdsa_session_activation_authorization_v1",
-			activation: result.ecdsaSession,
-			authorization: walletSessionAuthorization
-		};
-	}
-	if (activation && result.ecdsaSession && result.ecdsaActivationReceipt && result.ecdsaCustody) {
-		assertPasskeyEcdsaExchangeContinuity({
-			walletId: String(args.walletIdentity.walletId),
-			prepared: activation,
-			response: result.ecdsaSession,
-			activationReceipt: result.ecdsaActivationReceipt,
-			continuity: result.ecdsaCustody
-		});
-		if (result.ecdsaSession.kind === "router_ab_ecdsa_post_registration_session_activated_v1") sessionActivation = result.ecdsaSession;
-	}
-	const ecdsaSessionAuthority = sessionActivation ? await validatePasskeyWalletSessionAuthorization({
-		walletIdentity: args.walletIdentity,
-		rpId: args.rpId,
-		credential,
-		authorization: exactAuthorizationFromPasskeyEcdsaActivation(sessionActivation)
-	}) : null;
-	if (walletSessionAuthorizationToPersist) await walletSessionAuthorizations.writeExactWithOperationCredential(walletSessionAuthorizationToPersist);
-	if (activation?.requiresCustodyRejoin) {
-		if (!("ecdsaCustody" in result) || !result.ecdsaCustody) throw new Error("Passkey wallet unlock omitted ECDSA custody rejoin continuity");
-		const passkeyPrfFirstB64u = passkeyPrfFirstB64uFromCredential(credential);
-		if (!passkeyPrfFirstB64u) throw new Error("Passkey ECDSA custody rejoin requires WebAuthn PRF.first");
-		const credentialIdB64u = passkeyCredentialIdB64uFromAuthentication(credential);
-		const authority = ecdsaSessionAuthority?.reference ?? passkeySessionAuthority?.reference ?? await exactPasskeyWalletAuthAuthorityRefForCredential({
-			walletId: args.walletIdentity.walletId,
-			rpId: args.rpId,
-			credentialIdB64u
-		});
-		await restorePasskeyEcdsaCustodyLogin({
-			signingEngine: args.context.signingEngine,
-			walletId: String(args.walletIdentity.walletId),
-			custody: result.walletCustody,
-			continuity: result.ecdsaCustody,
-			authority,
-			passkeyPrfFirstB64u
-		});
-	}
-	return {
-		credential,
-		activation: activation && result.ecdsaSession && sessionActivation && ecdsaSessionAuthority ? {
-			...activation,
-			response: result.ecdsaSession,
-			sessionActivation,
-			authorizationIdentity: ecdsaSessionAuthority.identity,
-			activationReceipt: result.ecdsaActivationReceipt,
-			continuity: result.ecdsaCustody
-		} : null,
-		custody: result.walletCustody,
-		result
-	};
-}
-var LoginWarmupDeferred = class {
-	constructor() {
-		this.settled = false;
-		this.promise = new Promise(this.capturePromise.bind(this));
-	}
-	resolve(value) {
-		if (this.settled) return;
-		this.settled = true;
-		this.resolvePromise(value);
-	}
-	reject(error) {
-		if (this.settled) return;
-		this.settled = true;
-		this.rejectPromise(toError(error));
-	}
-	async wait() {
-		return await this.promise;
-	}
-	capturePromise(resolve, reject) {
-		this.resolvePromise = resolve;
-		this.rejectPromise = reject;
-	}
-};
-async function stageMintedLoginEd25519WalletSessionAuthority(context, minted) {
-	context.sharedState.ed25519.thresholdSessionId = String(minted.thresholdSessionId);
-	context.sharedState.ed25519.authorizationId = minted.authorizationId;
-	context.sharedState.ed25519.walletSessionId = minted.walletSessionId;
-	context.sharedState.ed25519.quotaId = minted.quotaId;
-	context.sharedState.ed25519.operationCredential = minted.operationCredential;
-	context.sharedState.ed25519.expiresAtMs = minted.expiresAtMs;
-	context.sharedState.ed25519.remainingUses = minted.remainingUses;
-	context.sharedState.ed25519.runtimePolicyScope = minted.runtimePolicyScope;
-	context.authorityDeferred?.resolve(minted);
-}
-function rejectLoginWarmupEd25519Deferreds(authorityDeferred, error) {
-	authorityDeferred?.reject(error);
-}
-function createActiveLoginSigningSessionStatus(args) {
-	return {
-		sessionId: String(args.session.thresholdSessionId),
-		status: "active",
-		authMethod: args.authMethod,
-		...args.authMethod === SIGNER_AUTH_METHODS.emailOtp ? { retention: "session" } : {},
-		remainingUses: args.session.remainingUses,
-		expiresAtMs: args.session.expiresAtMs
-	};
-}
-function isWalletSessionReconnectEcdsaRouteAuth(auth) {
-	return auth?.kind === "opaque_wallet_session_operation_credential_v1";
-}
-function publicCapabilityFromThresholdEcdsaBootstrap(bootstrap) {
-	const backendBinding = bootstrap.thresholdEcdsaKeyRef.backendBinding;
-	if (!backendBinding) return void 0;
-	switch (backendBinding.materialKind) {
-		case "role_local_worker_handle":
-		case "role_local_durable_sealed_ref":
-		case "role_local_durable_public_anchor": return backendBinding.publicFacts.publicCapability;
-		case "role_local_ready_state_blob": return backendBinding.ecdsaRoleLocalReadyRecord.publicFacts.publicCapability;
-		case "metadata_only": return;
-	}
-}
-function sharedEcdsaActivationKey(capability) {
-	return JSON.stringify(capability);
-}
-function preauthorizedEcdsaActivationFromBootstrap(bootstrap) {
-	const publicCapability = publicCapabilityFromThresholdEcdsaBootstrap(bootstrap);
-	if (!publicCapability) throw new Error("[login] ECDSA bootstrap is missing its public capability");
-	const session = bootstrap.session;
-	const normalSigning = bootstrap.thresholdEcdsaKeyRef.routerAbEcdsaDerivationNormalSigning;
-	if (!normalSigning) throw new Error("[login] ECDSA bootstrap is missing normal-signing state");
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activated_v1",
-		public_capability: publicCapability,
-		session: {
-			authorization_session_id: session.authorizationSessionId,
-			authorization_id: session.authorizationId,
-			threshold_session_id: requireThresholdLoginEcdsaSessionId(session.thresholdSessionId),
-			wallet_session_id: session.walletSessionId,
-			quota_id: session.quotaId,
-			expires_at_ms: session.expiresAtMs,
-			remaining_uses: session.remainingUses,
-			wallet_session: session.walletSession,
-			operation_credential: session.operationCredential
-		},
-		normal_signing: normalSigning
-	};
-}
-function sameEd25519ParticipantIds(left, right) {
-	return left.length === right.length && left.every((participantId, index) => participantId === right[index]);
-}
-function sameRouterAbEd25519NormalSigningState(left, right) {
-	return left.kind === right.kind && left.signingWorkerId === right.signingWorkerId;
-}
-function sameThresholdRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-function mergeThresholdEcdsaWarmSessionContexts(args) {
-	if (args.current.runtimePolicyScope && args.incoming.runtimePolicyScope && !sameThresholdRuntimePolicyScope(args.current.runtimePolicyScope, args.incoming.runtimePolicyScope)) throw new Error(`[login] threshold ECDSA ${args.source} has a conflicting runtime policy scope`);
-	return mergeCanonicalThresholdEcdsaWarmSessionContexts(args.current, args.incoming);
-}
-/** Public capability and authority are the manifest's half of the capability
-* split; the sealed record is only correlated runtime evidence. A persisted
-* capability on the configured target is used directly; otherwise the exact
-* manifest is resolved. There is deliberately no composite-record fallback --
-* absent canonical state is device-link-required, not a silent miss. */
-async function resolvePersistedEcdsaPublicCapabilityForLogin(args) {
-	if (args.targetEcdsaKey.publicCapability.kind === "persisted_public_capability") {
-		const publicCapability = args.targetEcdsaKey.publicCapability.value;
-		if (String(publicCapability.client_id) !== String(args.walletId)) throw new Error(`[login] threshold ECDSA persisted public capability wallet mismatch for ${thresholdEcdsaChainTargetKey(args.chainTarget)}`);
-		return publicCapability;
-	}
-	const resolved = await resolveBrowserActiveEcdsaCapabilityRuntime({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	});
-	if (resolved.kind !== "resolved") throw createThresholdEcdsaDeviceLinkRequiredError(thresholdEcdsaChainTargetKey(args.chainTarget));
-	const publicFacts = resolved.manifest.durableMaterial.roleLocalPublicFacts;
-	if (String(publicFacts.keyHandle) !== String(args.targetEcdsaKey.keyHandle) || String(publicFacts.walletId) !== String(args.walletId)) throw createThresholdEcdsaDeviceLinkRequiredError(thresholdEcdsaChainTargetKey(args.chainTarget));
-	return publicFacts.publicCapability;
-}
-function buildThresholdLoginWarmSignerSelection(signersToWarm) {
-	const normalized = [];
-	for (const signer of signersToWarm) {
-		if (signer !== "ed25519" && signer !== "ecdsa") continue;
-		if (normalized.includes(signer)) continue;
-		normalized.push(signer);
-	}
-	return normalized;
-}
-async function runThresholdLoginWarmupTask(task) {
-	try {
-		await task.run();
-		return {
-			kind: "succeeded",
-			task
-		};
-	} catch (error) {
-		task.onFailure?.(error);
-		return {
-			kind: "failed",
-			task,
-			error: toError(error)
-		};
-	}
-}
-async function runThresholdLoginWarmupTasks(tasks) {
-	const pendingBySigner = /* @__PURE__ */ new Map();
-	for (const task of tasks) pendingBySigner.set(task.signer, task);
-	const completed = /* @__PURE__ */ new Set();
-	while (pendingBySigner.size > 0) {
-		const ready = [];
-		for (const task of pendingBySigner.values()) if (task.dependencies.every((dep) => completed.has(dep))) ready.push(task);
-		if (ready.length === 0) throw new Error("[login] threshold warm-up task dependency graph is unsatisfied");
-		const outcomes = await Promise.all(ready.map(runThresholdLoginWarmupTask));
-		let firstFailure = null;
-		for (const outcome of outcomes) switch (outcome.kind) {
-			case "succeeded":
-				completed.add(outcome.task.signer);
-				pendingBySigner.delete(outcome.task.signer);
-				break;
-			case "failed":
-				firstFailure ??= outcome.error;
-				break;
-			default: return assertNeverLoginState(outcome);
-		}
-		if (firstFailure) throw firstFailure;
-	}
-}
-function resolveThresholdLoginWarmEcdsaBootstrapIdentity(args) {
-	args.routeAuthorization.kind;
-	if (args.credentialState.kind === "available") return {};
-	throw new Error("[login] threshold ECDSA warm-up requires route authorization");
-}
-function thresholdLoginWarmupErrorMessage(error) {
-	return String((error && typeof error === "object" && "message" in error ? error.message : error) || "");
-}
-function assertNeverLoginState(value) {
-	throw new Error(`[login] unexpected state: ${String(value)}`);
-}
-async function bootstrapLoginEcdsaSession(args) {
-	switch (args.runtimeScopeBootstrapState.kind) {
-		case "available": return await args.signingEngine.bootstrapEcdsaSession({
-			...args.request,
-			runtimeScopeBootstrap: args.runtimeScopeBootstrapState.runtimeScopeBootstrap
-		});
-		case "unavailable": return await args.signingEngine.bootstrapEcdsaSession(args.request);
-		default: return assertNeverLoginState(args.runtimeScopeBootstrapState);
-	}
-}
-function requireLoginWarmEd25519OperationCredential(session) {
-	if ("operationCredential" in session) return session.operationCredential;
-	throw new Error("[login] wallet custody Ed25519 activation requires the exact issued operation credential");
-}
-async function ensurePasskeyEd25519OwnerProfile(input) {
-	const existing = await input.signingEngine.getUserBySignerSlot(input.walletBinding.nearAccountId, input.signerSlot).catch(() => null);
-	if (existing) {
-		if (existing.walletId !== String(input.walletBinding.walletId) || existing.nearEd25519SigningKeyId !== String(input.walletBinding.nearEd25519SigningKeyId) || existing.signerSlot !== input.signerSlot) throw new Error("[login] local Ed25519 owner profile identity is invalid");
-		return;
-	}
-	await input.signingEngine.storeUserData({
-		walletId: String(input.walletBinding.walletId),
-		nearAccountId: input.walletBinding.nearAccountId,
-		nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-		signerSlot: input.signerSlot,
-		operationalPublicKey: `ed25519:${base58Encode(input.registeredPublicKey)}`,
-		passkeyCredential: {
-			id: input.credentialIdB64u,
-			rawId: input.credentialIdB64u
-		},
-		lastUpdated: Date.now(),
-		version: 2
-	});
-}
-function walletCustodyLoginActivationFacts(custody, thresholdSessionId) {
-	const capability = custody.ed25519.capability;
-	const continuity = capability.registrationContinuity;
-	return {
-		materialActivation: capability.materialActivation,
-		lifecycleId: capability.lifecycle.lifecycleId,
-		signingRootVersion: capability.lifecycle.rootShareEpoch,
-		signingRootId: capability.applicationBinding.signing_root_id,
-		signerSetId: capability.lifecycle.signerSetId,
-		thresholdSessionId,
-		activationTranscriptB64u: base64UrlEncode(Uint8Array.from(continuity.activationTranscript)),
-		activationCapabilityBindingB64u: base64UrlEncode(Uint8Array.from(capability.activeCapabilityBinding))
-	};
-}
-function assertWalletCustodyLoginIdentity(input) {
-	const ed25519 = input.custody.ed25519;
-	const capability = ed25519.capability;
-	if (ed25519.nearAccountId !== String(input.walletBinding.nearAccountId) || ed25519.nearEd25519SigningKeyId !== String(input.walletBinding.nearEd25519SigningKeyId) || ed25519.signerSlot !== input.signerSlot || capability.applicationBinding.wallet_id !== String(input.walletBinding.walletId) || capability.applicationBinding.near_ed25519_signing_key_id !== String(input.walletBinding.nearEd25519SigningKeyId) || capability.applicationBinding.key_creation_signer_slot !== input.signerSlot || capability.nearAccountId !== input.walletBinding.nearAccountId || capability.lifecycle.accountId !== String(input.walletBinding.walletId) || capability.lifecycle.signingWorkerId !== ed25519.relayerKeyId) throw new Error("[login] wallet custody identity does not match the selected signing lane");
-}
-async function openAndActivatePasskeyEd25519CustodyLogin(input) {
-	assertWalletCustodyLoginIdentity(input);
-	const capability = input.custody.ed25519.capability;
-	const cached = await input.signingEngine.loadWalletCustodyEd25519Material({
-		nearAccountId: String(input.walletBinding.nearAccountId),
-		signerSlot: input.signerSlot,
-		expectedRegisteredPublicKeyB64u: base64UrlEncode(Uint8Array.from(capability.registeredPublicKey))
-	});
-	const thresholdSessionId = parseThresholdEd25519SessionId(input.walletSession.thresholdSessionId);
-	if (!thresholdSessionId.ok) throw new Error("[login] wallet custody returned an invalid threshold session identity");
-	const activation = walletCustodyLoginActivationFacts(input.custody, thresholdSessionId.value);
-	const envelope = walletCustodyCacheEnvelopeFromRecordV1(input.custody.envelope);
-	let activeClient = null;
-	let rejoinSecret = null;
-	let openSecret = null;
-	try {
-		if (cached.kind === "found") {
-			openSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
-			activeClient = await openWalletCustodyEd25519ActiveClientV1({
-				material: cached.material,
-				activation,
-				envelope,
-				ownedFactorSecret: openSecret
-			});
-		} else {
-			const custodyWire = joinCustodyWireFromEnvelopeRecord(input.custody.envelope);
-			if (!custodyWire.ok) throw new Error(custodyWire.reason);
-			rejoinSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
-			openSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
-			const rejoined = await input.signingEngine.rejoinWalletCustodyNearEd25519KeySet({
-				walletId: String(input.walletBinding.walletId),
-				custodyJson: custodyWire.custodyJson,
-				factorSecret: rejoinSecret.buffer,
-				nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-				recoveryBasis: capability,
-				routerOrigin: new URL(input.relayerUrl).origin,
-				walletSessionToken: requireLoginWarmEd25519OperationCredential(input.walletSession).token
-			});
-			const materialBinding = {
-				kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-				applicationBindingDigestB64u: rejoined.localMaterial.applicationBindingDigestB64u,
-				registeredPublicKeyB64u: base64UrlEncode(rejoined.metadata.registeredPublicKey),
-				participantIds: rejoined.metadata.participantIds,
-				stateEpoch: String(rejoined.metadata.stateEpoch),
-				walletId: String(input.walletBinding.walletId),
-				nearAccountId: String(input.walletBinding.nearAccountId),
-				nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-				signerSlot: input.signerSlot,
-				signingWorkerId: input.custody.ed25519.relayerKeyId,
-				signingWorkerVerifyingShareB64u: base64UrlEncode(rejoined.metadata.signingWorkerVerifyingShare)
-			};
-			const sealed = {
-				ciphertextB64u: rejoined.localMaterial.b64u,
-				nonceB64u: rejoined.localMaterial.nonceB64u
-			};
-			try {
-				await input.signingEngine.persistWalletCustodyEd25519Material({
-					binding: materialBinding,
-					sealed
-				});
-			} catch (error) {
-				console.warn("[login] wallet custody cache write failed; continuing with verified material", { error });
-			}
-			activeClient = await openWalletCustodyEd25519ActiveClientV1({
-				material: {
-					binding: materialBinding,
-					sealed
-				},
-				activation: walletCustodyActivationFactsFromActiveClientMetadataV1(rejoined.metadata),
-				envelope,
-				ownedFactorSecret: openSecret
-			});
-		}
-		if (!activeClient) throw new Error("[login] wallet custody produced no active client");
-		const recoveredThresholdSessionId = parseThresholdEd25519SessionId(activeClient.metadata().scope.threshold_session_id);
-		if (!recoveredThresholdSessionId.ok) throw new Error("[login] wallet custody returned an invalid threshold session identity");
-		if (recoveredThresholdSessionId.value !== input.walletSession.thresholdSessionId) throw new Error("[login] wallet custody changed the threshold session identity");
-		const envelopeFactor = input.custody.envelope.factor;
-		if (envelopeFactor.kind !== "passkey") throw new Error("[login] wallet custody returned a different factor authority");
-		await ensurePasskeyEd25519OwnerProfile({
-			signingEngine: input.signingEngine,
-			walletBinding: input.walletBinding,
-			signerSlot: input.signerSlot,
-			credentialIdB64u: envelopeFactor.credentialIdB64u,
-			registeredPublicKey: activeClient.metadata().registeredPublicKey
-		});
-		await persistPasskeyEd25519YaoSignerMaterialV1({
-			store: IndexedDBManager,
-			activeClient,
-			identity: {
-				walletId: String(input.walletBinding.walletId),
-				nearAccountId: String(input.walletBinding.nearAccountId),
-				nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-				thresholdSessionId: recoveredThresholdSessionId.value,
-				signerSlot: input.signerSlot,
-				rpId: envelopeFactor.rpId,
-				credentialIdB64u: envelopeFactor.credentialIdB64u,
-				signingRootId: capability.applicationBinding.signing_root_id,
-				signingRootVersion: capability.lifecycle.rootShareEpoch,
-				signingWorkerId: input.custody.ed25519.relayerKeyId
-			},
-			stableServerScope: {
-				relayerKeyId: input.custody.ed25519.relayerKeyId,
-				participantIds: input.custody.ed25519.participantIds,
-				runtimePolicyScope: capability.runtimePolicyScope,
-				routerAbNormalSigning: input.routerAbNormalSigning
-			},
-			passkeyPrfFirstB64u: input.passkeyPrfFirstB64u
-		});
-		const activated = await input.signingEngine.activateVerifiedNearEd25519YaoMaterial({
-			activeClient,
-			facts: {
-				thresholdSessionId: recoveredThresholdSessionId.value,
-				signer: nearEd25519SignerBindingFromBoundaryFields({
-					walletId: input.walletBinding.walletId,
-					nearAccountId: input.walletBinding.nearAccountId,
-					nearEd25519SigningKeyId: input.walletBinding.nearEd25519SigningKeyId,
-					signerSlot: input.signerSlot
-				}),
-				signingRootId: capability.applicationBinding.signing_root_id,
-				signingRootVersion: capability.lifecycle.rootShareEpoch,
-				routerAbNormalSigning: input.routerAbNormalSigning,
-				runtimePolicyScope: capability.runtimePolicyScope,
-				relayerUrl: input.relayerUrl
-			}
-		});
-		const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-			walletId: String(input.walletBinding.walletId),
-			nearAccountId: String(input.walletBinding.nearAccountId),
-			nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-			walletSessionId: input.walletSession.walletSessionId,
-			authorizationId: input.walletSession.authorizationId,
-			quotaId: input.walletSession.quotaId,
-			thresholdSessionId: recoveredThresholdSessionId.value,
-			remainingUses: input.walletSession.remainingUses,
-			expiresAtMs: input.walletSession.expiresAtMs,
-			runtimePolicyScope: input.walletSession.runtimePolicyScope,
-			signingRootId: capability.applicationBinding.signing_root_id,
-			signingRootVersion: capability.lifecycle.rootShareEpoch,
-			routerAbNormalSigning: input.routerAbNormalSigning,
-			walletSessionToken: requireLoginWarmEd25519OperationCredential(input.walletSession).token,
-			nowMs: Math.min(Date.now(), input.walletSession.expiresAtMs - 1)
-		});
-		if (!signingWalletSession.ok) throw new Error(`[login] wallet custody returned an unusable Ed25519 Wallet Session: ${signingWalletSession.reason}`);
-		const session = buildPasskeyRouterAbEd25519WalletSessionState({
-			walletId: input.walletBinding.walletId,
-			nearAccountId: input.walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: input.walletBinding.nearEd25519SigningKeyId,
-			signerSlot: input.signerSlot,
-			rpId: toRpId(envelopeFactor.rpId),
-			credentialIdB64u: envelopeFactor.credentialIdB64u,
-			relayerUrl: input.relayerUrl,
-			authority: input.authority,
-			signingWalletSession: signingWalletSession.value
-		});
-		await persistPasskeyEd25519YaoSessionForRefresh({
-			persistence: input.signingEngine,
-			session,
-			prfFirstB64u: input.passkeyPrfFirstB64u,
-			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-				rpId: envelopeFactor.rpId,
-				nearAccountId: String(input.walletBinding.nearAccountId),
-				nearEd25519SigningKeyId: String(input.walletBinding.nearEd25519SigningKeyId),
-				relayerKeyId: input.custody.ed25519.relayerKeyId,
-				participantIds: input.custody.ed25519.participantIds,
-				runtimePolicyScope: input.walletSession.runtimePolicyScope,
-				signerSlot: input.signerSlot,
-				routerAbNormalSigning: input.routerAbNormalSigning,
-				credentialIdB64u: envelopeFactor.credentialIdB64u,
-				materialActivation: activated.materialActivation
-			}),
-			materialActivation: activated.materialActivation
-		});
-		await input.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({
-			existingEnvelope: input.custody.envelope,
-			passkeyPrfFirstB64u: input.passkeyPrfFirstB64u,
-			walletId: String(input.walletBinding.walletId),
-			walletAuthMethodId: String(input.authority.walletAuthMethodId),
-			walletSessionId: String(input.walletSession.walletSessionId),
-			expiresAtMs: input.walletSession.expiresAtMs
-		});
-	} catch (error) {
-		activeClient?.dispose();
-		throw error;
-	} finally {
-		rejoinSecret?.fill(0);
-		openSecret?.fill(0);
-	}
-}
-function ethereumAddressFromEcdsaIdentityB64u(value) {
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== 20) throw new Error("[login] ECDSA custody address is invalid");
-	let hex = "0x";
-	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
-	return hex;
-}
-function nonEmptyEcdsaCustodyChainTargets(signers) {
-	const [first, ...rest] = signers;
-	if (!first) throw new Error("[login] passkey ECDSA custody continuity is empty");
-	return [first.chainTarget, ...rest.map((signer) => signer.chainTarget)];
-}
-async function restorePasskeyEcdsaCustodyLogin(input) {
-	const first = input.continuity.signers[0];
-	if (!first) throw new Error("[login] passkey ECDSA custody continuity is empty");
-	if (first.walletKey.walletId !== input.walletId) throw new Error("[login] passkey ECDSA custody continuity changed wallet identity");
-	for (const signer of input.continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameThresholdRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("[login] passkey ECDSA custody continuity conflicts across targets");
-	const custodyWire = joinCustodyWireFromEnvelopeRecord(input.custody.envelope);
-	if (!custodyWire.ok) throw new Error(custodyWire.reason);
-	const factorSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
-	try {
-		const rejoined = await input.signingEngine.rejoinWalletCustodyEvmFamilyKeySet({
-			walletId: input.walletId,
-			custodyJson: custodyWire.custodyJson,
-			factorSecret: factorSecret.buffer,
-			evmFamilySigningKeySlotId: deriveEvmFamilySigningKeySlotId({
-				walletId: input.walletId,
-				signingRootId: first.walletKey.signingRootId,
-				signingRootVersion: first.walletKey.signingRootVersion
-			}),
-			applicationBindingDigestB64u: first.walletKey.publicCapability.context.application_binding_digest_b64u,
-			registeredClientRootPublicKey33B64u: first.walletKey.derivationClientSharePublicKey33B64u,
-			relayerPublicIdentityJson: JSON.stringify({
-				relayerKeyId: first.walletKey.relayerKeyId,
-				relayerPublicKey33B64u: first.activationReceipt.ecdsa_activation.public_identity.server_public_key33_b64u,
-				groupPublicKey33B64u: first.activationReceipt.ecdsa_activation.public_identity.threshold_public_key33_b64u,
-				ethereumAddress: ethereumAddressFromEcdsaIdentityB64u(first.activationReceipt.ecdsa_activation.public_identity.ethereum_address20_b64u),
-				relayerShareRetryCounter: first.activationReceipt.ecdsa_activation.public_identity.server_share_retry_counter
-			})
-		});
-		assertRejoinedPasskeyEcdsaPublicFacts({
-			publicFacts: rejoined.publicFacts,
-			signer: first
-		});
-		await input.signingEngine.restoreWalletCustodyEcdsaContinuity({
-			authority: input.authority,
-			chainTargets: nonEmptyEcdsaCustodyChainTargets(input.continuity.signers),
-			walletId: first.walletKey.walletId,
-			keyHandle: first.walletKey.keyHandle,
-			ecdsaThresholdKeyId: first.walletKey.ecdsaThresholdKeyId,
-			signingRootId: first.walletKey.signingRootId,
-			signingRootVersion: first.walletKey.signingRootVersion,
-			relayerKeyId: first.walletKey.relayerKeyId,
-			participantIds: first.walletKey.participantIds,
-			publicCapability: first.walletKey.publicCapability,
-			activationReceipt: first.activationReceipt,
-			runtimePolicyScope: first.runtimePolicyScope,
-			readyStateBlobB64u: rejoined.readyStateBlobB64u,
-			publicFacts: rejoined.publicFacts
-		});
-	} finally {
-		factorSecret.fill(0);
-	}
-}
-async function primeThresholdLoginWarmSigners(args) {
-	const signersToWarm = buildThresholdLoginWarmSignerSelection(args.signersToWarm);
-	const credential = args.credentialState.kind === "available" ? args.credentialState.credential : void 0;
-	const localPasskeyCredentialIdB64u = args.credentialState.localPasskeyCredentialIdB64u;
-	const runtimeScopeBootstrap = args.runtimeScopeBootstrapState.kind === "available" ? args.runtimeScopeBootstrapState.runtimeScopeBootstrap : null;
-	const initialCanonicalEcdsaContext = args.ecdsaContext;
-	const sharedState = {
-		activeCanonicalEcdsaContext: initialCanonicalEcdsaContext,
-		ed25519: {
-			thresholdSessionId: "",
-			authorizationId: null,
-			walletSessionId: null,
-			quotaId: null,
-			operationCredential: null,
-			expiresAtMs: 0,
-			remainingUses: 0,
-			runtimePolicyScope: null
-		}
-	};
-	const authorityDeferred = args.ecdsaDependency.kind === "ed25519_wallet_session_authority" ? new LoginWarmupDeferred() : null;
-	const ecdsaThresholdSessionState = { generatedThresholdSessionId: args.passkeyExchangeEcdsaActivation?.policy.session_policy.threshold_session_id || "" };
-	const unlockRemainingUses = args.unlockRemainingUses;
-	const ecdsaBootstraps = [];
-	let ed25519Session = null;
-	let ecdsaAuthorizedEd25519Mint = null;
-	const tasks = [];
-	if (signersToWarm.includes("ed25519")) tasks.push({
-		signer: "ed25519",
-		dependencies: args.ed25519DependsOnEcdsa ? ["ecdsa"] : [],
-		onFailure: authorityDeferred ? rejectLoginWarmupEd25519Deferreds.bind(void 0, authorityDeferred) : null,
-		run: async () => {
-			const walletBinding = requireNearLoginWalletBinding(args.walletIdentity);
-			const ecdsaMint = ecdsaAuthorizedEd25519Mint;
-			const ed25519SessionAuthority = bindLoginEd25519SessionAuthorityToAuthenticatedCredential({
-				authority: requireRequestedLoginEd25519SessionAuthority(args.ed25519SessionAuthority),
-				walletId: walletBinding.walletId,
-				rpId: args.context.signingEngine.getRpId(),
-				credentialIdB64u: localPasskeyCredentialIdB64u
-			});
-			const ed25519ProvisioningIdentity = resolveLoginWarmEd25519ProvisioningIdentity({
-				mintPlan: args.ed25519MintPlan,
-				ecdsaMint,
-				walletBinding,
-				signerSlot: args.signerSlot,
-				authority: ed25519SessionAuthority
-			});
-			const provisionScope = resolveLoginEd25519ProvisionScope({
-				mintPlan: args.ed25519MintPlan,
-				fallback: {
-					relayerKeyId: args.relayerKeyId,
-					participantIds: args.participantIds,
-					runtimePolicyScope: initialCanonicalEcdsaContext.runtimePolicyScope ?? null,
-					routerAbNormalSigning: createRouterAbNormalSigningPolicy(args.context.configs)
-				}
-			});
-			const sharedEd25519ConnectArgs = {
-				relayerUrl: args.relayerUrl,
-				relayerKeyId: provisionScope.relayerKeyId,
-				runtimePolicyScope: provisionScope.runtimePolicyScope || void 0,
-				routerAbNormalSigning: provisionScope.routerAbNormalSigning,
-				runtimeScopeBootstrap: runtimeScopeBootstrap || void 0,
-				participantIds: provisionScope.participantIds,
-				ttlMs: args.ttlMs,
-				remainingUses: unlockRemainingUses,
-				onWalletSessionAuthorityReady: stageMintedLoginEd25519WalletSessionAuthority.bind(void 0, {
-					sharedState,
-					authorityDeferred
-				})
-			};
-			const commonEd25519ConnectArgs = ed25519ProvisioningIdentity.kind === "fresh_ed25519_provisioning" ? {
-				...ed25519ProvisioningIdentity,
-				walletId: String(walletBinding.walletId),
-				nearAccountId: walletBinding.nearAccountId,
-				nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-				signerSlot: args.signerSlot,
-				...sharedEd25519ConnectArgs
-			} : {
-				...ed25519ProvisioningIdentity,
-				...sharedEd25519ConnectArgs
-			};
-			let connected;
-			switch (ed25519SessionAuthority.kind) {
-				case "email_otp":
-					connected = await args.signingEngine.connectEd25519Session({
-						...commonEd25519ConnectArgs,
-						source: "email_otp",
-						authority: ed25519SessionAuthority.authority,
-						emailOtpAuthContext: ed25519SessionAuthority.emailOtpAuthContext,
-						materialActivation: void 0
-					});
-					break;
-				case "passkey":
-					if (!args.passkeyUnlockEd25519Session) throw new Error("[login] verified wallet unlock omitted its Ed25519 Wallet Session");
-					if (args.ed25519MintPlan.kind !== "wallet_custody") throw new Error("[login] verified unlock Ed25519 session requires wallet custody");
-					connected = passkeyUnlockEd25519Connection({
-						session: args.passkeyUnlockEd25519Session,
-						walletBinding,
-						signerSlot: args.signerSlot,
-						custody: args.ed25519MintPlan.custody,
-						provisionScope,
-						credential,
-						remainingUses: unlockRemainingUses,
-						unlockAuthorization: args.passkeyUnlockWalletSessionAuthorization
-					});
-					break;
-				default: return assertNeverLoginState(ed25519SessionAuthority);
-			}
-			if (!connected.ok) {
-				const details = String(connected.message || connected.code || "Failed to connect threshold Ed25519 session");
-				throw new Error(`[login] threshold Ed25519 warm-up failed: ${details}`);
-			}
-			ed25519Session = connected;
-			if (!connected.thresholdSessionId) throw new Error("[login] threshold Ed25519 warm-up did not return a thresholdSessionId");
-			const connectedAuthority = ed25519SessionAuthority.kind === "passkey" ? await exactPasskeyWalletAuthAuthorityRefForCredential({
-				walletId: walletBinding.walletId,
-				rpId: args.context.signingEngine.getRpId(),
-				credentialIdB64u: passkeyCredentialIdB64uFromAuthentication(credential || void 0) || localPasskeyCredentialIdB64u
-			}) : await walletAuthAuthorityRef({ authority: ed25519SessionAuthority.authority.authority });
-			if (args.ed25519MintPlan.kind === "wallet_custody") {
-				if (ed25519SessionAuthority.kind !== "passkey") throw new Error("[login] wallet custody requires passkey authority");
-				const expectedMaterialActivation = resolveLoginPasskeyMaterialActivation(ed25519ProvisioningIdentity, args.ed25519MintPlan);
-				const passkeyPrfFirstB64u = credential ? passkeyPrfFirstB64uFromCredential(credential) : "";
-				if (!passkeyPrfFirstB64u) throw new Error("[login] wallet custody requires WebAuthn PRF.first");
-				await args.signingEngine.withExactEd25519MaterialOwner({
-					materialActivation: expectedMaterialActivation,
-					nearAccountId: walletBinding.nearAccountId,
-					task: openAndActivatePasskeyEd25519CustodyLogin.bind(void 0, {
-						signingEngine: args.signingEngine,
-						custody: args.ed25519MintPlan.custody,
-						walletBinding,
-						signerSlot: args.signerSlot,
-						passkeyPrfFirstB64u,
-						walletSession: connected,
-						authority: connectedAuthority,
-						routerAbNormalSigning: provisionScope.routerAbNormalSigning,
-						relayerUrl: args.relayerUrl
-					})
-				});
-			}
-		}
-	});
-	if (signersToWarm.includes("ecdsa")) tasks.push({
-		signer: "ecdsa",
-		dependencies: [],
-		onFailure: null,
-		run: async () => {
-			await authorityDeferred?.promise;
-			let bootstrapIdentity = null;
-			let consumedPasskeyExchangeActivation = false;
-			const activationByMaterial = /* @__PURE__ */ new Map();
-			const configuredEcdsaTargets = listConfiguredThresholdEcdsaPublicationTargets(args.context.configs.network.chains);
-			const completeActiveContextFromConfiguredTargets = (source) => {
-				const completion = buildConfiguredTargetKeyCompletion({
-					context: sharedState.activeCanonicalEcdsaContext,
-					configuredTargets: configuredEcdsaTargets
-				});
-				if (completion.kind === "complete_configured_target_keys") {
-					sharedState.activeCanonicalEcdsaContext = completion.context;
-					return;
-				}
-				if (completion.kind === "missing_configured_target_keys") return;
-				requireCompleteConfiguredTargetKeyContext({
-					completion,
-					source
-				});
-			};
-			const rememberEcdsaAuthorizedEd25519Mint = (bootstrap) => {
-				if (ecdsaAuthorizedEd25519Mint) return;
-				const operationCredential = bootstrap.session.operationCredential;
-				const passkeyPrfFirstB64u = credential ? passkeyPrfFirstB64uFromCredential(credential) : "";
-				const passkeyCredentialIdB64u = passkeyCredentialIdB64uFromAuthentication(credential || void 0) || localPasskeyCredentialIdB64u;
-				if (!operationCredential.token || !passkeyPrfFirstB64u || !passkeyCredentialIdB64u) return;
-				ecdsaAuthorizedEd25519Mint = {
-					operationCredential,
-					passkeyPrfFirstB64u,
-					passkeyCredentialIdB64u,
-					quotaId: bootstrap.session.quotaId
-				};
-			};
-			const resolveCurrentBootstrapIdentity = () => {
-				if (sharedState.ed25519.operationCredential) return { routeAuth: sharedState.ed25519.operationCredential };
-				const operationCredential = ecdsaAuthorizedEd25519Mint?.operationCredential;
-				if (operationCredential) return { routeAuth: operationCredential };
-				if (bootstrapIdentity) return bootstrapIdentity;
-				bootstrapIdentity = resolveThresholdLoginWarmEcdsaBootstrapIdentity({
-					credentialState: args.credentialState,
-					routeAuthorization: args.routeAuthorization
-				});
-				return bootstrapIdentity;
-			};
-			const bootstrapTarget = async (target, targetEcdsaKey) => {
-				if (!targetEcdsaKey.key) throw new Error("[login] threshold ECDSA warm-up requires configured target key identity");
-				const publicCapability = await resolvePersistedEcdsaPublicCapabilityForLogin({
-					walletId: args.walletIdentity.walletId,
-					chainTarget: target.chainTarget,
-					targetEcdsaKey
-				});
-				const reusedMaterialActivation = activationByMaterial.get(sharedEcdsaActivationKey(publicCapability));
-				const exchangeActivation = args.passkeyExchangeEcdsaActivation;
-				const matchingExchangeActivation = exchangeActivation && !consumedPasskeyExchangeActivation && exchangeActivation.targetKey === thresholdEcdsaChainTargetKey(target.chainTarget) ? exchangeActivation : null;
-				const preauthorized = matchingExchangeActivation ? {
-					sessionActivation: matchingExchangeActivation.sessionActivation,
-					authorizationIdentity: matchingExchangeActivation.authorizationIdentity
-				} : reusedMaterialActivation ?? null;
-				const thresholdSessionId = preauthorized ? thresholdSessionIdFromPasskeyEcdsaActivation(preauthorized.sessionActivation) : resolveThresholdLoginWarmEcdsaThresholdSessionId({ sharedState: ecdsaThresholdSessionState });
-				const runtimePolicyScope = sharedState.activeCanonicalEcdsaContext.runtimePolicyScope;
-				if (!runtimePolicyScope) throw new Error("[login] ECDSA session lane requires runtimePolicyScope");
-				const lanePolicy = buildEvmFamilyEcdsaSessionLanePolicy({
-					chainTarget: target.chainTarget,
-					thresholdSessionId,
-					ttlMs: args.ttlMs,
-					remainingUses: unlockRemainingUses,
-					runtimePolicyScope
-				});
-				const existingRoleLocalMaterial = targetEcdsaKey.existingRoleLocalMaterial;
-				if (!existingRoleLocalMaterial) throw createThresholdEcdsaDeviceLinkRequiredError(thresholdEcdsaChainTargetKey(target.chainTarget));
-				if (!localPasskeyCredentialIdB64u) throw new Error("[login] ECDSA role-local activation requires passkey identity");
-				const authorizationAuthority = existingRoleLocalMaterial.authority;
-				if (preauthorized) {
-					if (matchingExchangeActivation) consumedPasskeyExchangeActivation = true;
-					return await bootstrapLoginEcdsaSession({
-						signingEngine: args.signingEngine,
-						runtimeScopeBootstrapState: args.runtimeScopeBootstrapState,
-						request: {
-							kind: "passkey_preauthorized_ecdsa_bootstrap",
-							source: "login",
-							relayerUrl: args.relayerUrl,
-							keyHandle: toEvmFamilyEcdsaKeyHandle(targetEcdsaKey.keyHandle),
-							key: targetEcdsaKey.key,
-							lanePolicy,
-							publicCapability,
-							existingRoleLocalMaterial,
-							authorizationAuthority,
-							authorizationIdentity: preauthorized.authorizationIdentity,
-							passkeyCredentialIdB64u: localPasskeyCredentialIdB64u,
-							sessionActivation: preauthorized.sessionActivation
-						}
-					});
-				}
-				const reconnectRouteAuth = resolveCurrentBootstrapIdentity().routeAuth;
-				if (!isWalletSessionReconnectEcdsaRouteAuth(reconnectRouteAuth)) throw new Error("[login] ECDSA role-local activation requires a verified Wallet Session");
-				return await bootstrapLoginEcdsaSession({
-					signingEngine: args.signingEngine,
-					runtimeScopeBootstrapState: args.runtimeScopeBootstrapState,
-					request: {
-						kind: "wallet_session_reconnect_ecdsa_bootstrap",
-						source: "login",
-						relayerUrl: args.relayerUrl,
-						keyHandle: toEvmFamilyEcdsaKeyHandle(targetEcdsaKey.keyHandle),
-						key: targetEcdsaKey.key,
-						lanePolicy,
-						publicCapability,
-						existingRoleLocalMaterial,
-						authorizationAuthority,
-						passkeyCredentialIdB64u: localPasskeyCredentialIdB64u,
-						routeAuth: reconnectRouteAuth
-					}
-				});
-			};
-			const bootstrapConfiguredTargets = async () => {
-				completeActiveContextFromConfiguredTargets("login ECDSA warm-up preflight");
-				const orderedConfiguredEcdsaTargets = [];
-				const preauthorizedTargetKey = args.passkeyExchangeEcdsaActivation?.targetKey || null;
-				if (preauthorizedTargetKey) {
-					for (const target of configuredEcdsaTargets) if (thresholdEcdsaChainTargetKey(target.chainTarget) === preauthorizedTargetKey) orderedConfiguredEcdsaTargets.push(target);
-				}
-				for (const target of configuredEcdsaTargets) if (thresholdEcdsaChainTargetKey(target.chainTarget) !== preauthorizedTargetKey) orderedConfiguredEcdsaTargets.push(target);
-				for (const target of orderedConfiguredEcdsaTargets) {
-					const targetKey = thresholdEcdsaChainTargetKey(target.chainTarget);
-					const targetEcdsaKey = sharedState.activeCanonicalEcdsaContext.ecdsaKeys.find((key) => key.targetKey === targetKey);
-					const keyHandle = String(targetEcdsaKey?.keyHandle || "").trim();
-					if (!targetEcdsaKey?.key || !keyHandle) throw createThresholdEcdsaDeviceLinkRequiredError(targetKey);
-					const bootstrap = await bootstrapTarget(target, targetEcdsaKey);
-					ecdsaBootstraps.push(bootstrap);
-					scheduleEcdsaSessionPresignaturePrefill({
-						statusReads: args.statusReads,
-						trigger: "unlock",
-						signingEngine: args.signingEngine,
-						walletId: args.walletIdentity.walletId,
-						chainTarget: target.chainTarget
-					});
-					rememberEcdsaAuthorizedEd25519Mint(bootstrap);
-					const activation = preauthorizedEcdsaActivationFromBootstrap(bootstrap);
-					const activationKey = sharedEcdsaActivationKey(activation.public_capability);
-					if (!activationByMaterial.has(activationKey)) {
-						const activationAuthority = await resolveActivePasskeyWalletSessionAuthority({
-							walletId: args.walletIdentity.walletId,
-							authorization: {
-								record: bootstrap.session.walletSession,
-								operationCredential: bootstrap.session.operationCredential
-							}
-						});
-						activationByMaterial.set(activationKey, {
-							sessionActivation: activation,
-							authorizationIdentity: activationAuthority.identity
-						});
-					}
-					if (String(bootstrap.thresholdEcdsaKeyRef?.keyHandle || "").trim() !== targetEcdsaKey.keyHandle) throw new Error(`[login] threshold ECDSA warm-up returned a different keyHandle for ${targetKey}`);
-				}
-				if (args.passkeyExchangeEcdsaActivation && !consumedPasskeyExchangeActivation) throw new Error("[login] passkey exchange ECDSA activation did not match a configured target");
-			};
-			try {
-				await bootstrapConfiguredTargets();
-			} catch (error) {
-				const details = thresholdLoginWarmupErrorMessage(error) || "Failed to bootstrap threshold ECDSA session";
-				throw new Error(`[login] threshold ECDSA warm-up failed: ${details}`);
-			}
-		}
-	});
-	await runThresholdLoginWarmupTasks(tasks);
-	return {
-		ecdsaBootstraps,
-		ed25519Session
-	};
-}
-async function getWalletSession(context, walletId) {
-	let currentAuthentication = context.signingEngine.readWalletAuthenticationState();
-	const requestedWalletId = walletId ?? (currentAuthentication.kind !== "signed_out" ? currentAuthentication.walletId : void 0);
-	let requestedWalletIdValue = null;
-	let requestedAuthenticationRead = null;
-	if (requestedWalletId !== void 0) {
-		const parsedRequestedWalletId = parseWalletId(String(requestedWalletId));
-		if (parsedRequestedWalletId.ok) {
-			requestedWalletIdValue = parsedRequestedWalletId.value;
-			requestedAuthenticationRead = await readExactWalletSessionAuthentication({
-				walletId: parsedRequestedWalletId.value,
-				ports: browserExactWalletSessionReadPorts
-			});
-			if (requestedAuthenticationRead.kind === "upgrade_required") throw new WalletSessionAuthorizationUpgradeRequiredError("[WalletSession] Wallet Session authorization requires a newer client");
-			if (requestedAuthenticationRead.kind === "missing") currentAuthentication = { kind: "signed_out" };
-		}
-	}
-	let readResolution = await resolveWalletCapabilitySubjectResolution(requestedWalletId);
-	if (readResolution.kind === "no_session_for_wallet") {
-		const linkedSubjectSet = await resolveLinkedDeviceUnlockSubjectSet(String(readResolution.walletId));
-		if (linkedSubjectSet) readResolution = {
-			kind: "resolved",
-			walletId: readResolution.walletId,
-			subjectSet: linkedSubjectSet,
-			source: "local_wallet_authority"
-		};
-	}
-	let didReconcileEcdsaActivation = false;
-	if (readResolution.kind === "no_session_request") return buildAnonymousWalletSession();
-	if (readResolution.kind === "no_session_for_wallet") {
-		const journalSelectors = await resolveEcdsaActivationJournalSelectors(readResolution.walletId);
-		if (journalSelectors.kind !== "resolved") return await buildCapabilityUnresolvableWalletSession({
-			context,
-			walletId: readResolution.walletId,
-			reason: "activation_reconciliation_failed"
-		});
-		if (journalSelectors.selectors.length > 0) {
-			didReconcileEcdsaActivation = true;
-			const reconciliation = await reconcileCanonicalEcdsaActivationSelectors({
-				workerCtx: context.signingEngine.getSignerWorkerContext(),
-				selectors: journalSelectors.selectors
-			});
-			if (reconciliation.didFinalize) readResolution = await resolveWalletCapabilitySubjectResolution(readResolution.walletId);
-			if (readResolution.kind === "no_session_for_wallet" && reconciliation.kind !== "settled") return await buildCapabilityUnresolvableWalletSession({
-				context,
-				walletId: readResolution.walletId,
-				reason: reconciliation.kind === "pending" ? "activation_reconciliation_pending" : "activation_reconciliation_failed"
-			});
-		}
-	}
-	if (readResolution.kind === "no_session_for_wallet") return await buildCapabilityUnresolvableWalletSession({
-		context,
-		walletId: readResolution.walletId,
-		reason: readResolution.reason
-	});
-	if (readResolution.kind === "no_session_request") return buildAnonymousWalletSession();
-	if (readResolution.kind === "unresolvable_profile") {
-		console.warn("[WalletSession] wallet session profile is unresolvable", {
-			profileId: readResolution.profileId,
-			reason: readResolution.reason
-		});
-		return buildAnonymousWalletSession();
-	}
-	if (readResolution.kind === "unresolvable") {
-		console.warn("[WalletSession] wallet session identity is unresolvable", {
-			walletId: String(readResolution.walletId),
-			reason: readResolution.reason
-		});
-		return await buildCapabilityUnresolvableWalletSession({
-			context,
-			walletId: readResolution.walletId,
-			reason: readResolution.reason
-		});
-	}
-	const activeEcdsaSelectors = ecdsaActivationSelectorsFromSubjectSet(readResolution.subjectSet);
-	if (!didReconcileEcdsaActivation && activeEcdsaSelectors.length > 0) reportNonSettledEcdsaActivationReconciliation(await reconcileCanonicalEcdsaActivationSelectors({
-		workerCtx: context.signingEngine.getSignerWorkerContext(),
-		selectors: activeEcdsaSelectors
-	}));
-	await context.signingEngine.assertSealedRefreshStartupParity().catch((error) => {
-		console.warn("[WalletSession] sealed refresh startup parity check failed during session read; continuing with cached login state", error instanceof Error ? error.message : String(error || "unknown error"));
-	});
-	const [appIdentity, availableLanes] = await Promise.all([resolveWalletSessionAppIdentity(context, readResolution), readExactWalletSessionAvailableLanes(context, readResolution.walletId)]);
-	const restoredAuthenticationRead = requestedAuthenticationRead && requestedWalletIdValue && String(requestedWalletIdValue) === String(readResolution.walletId) ? requestedAuthenticationRead : await readExactWalletSessionAuthentication({
-		walletId: readResolution.walletId,
-		ports: browserExactWalletSessionReadPorts
-	});
-	let authentication = { kind: "signed_out" };
-	switch (restoredAuthenticationRead.kind) {
-		case "authenticated":
-			if (await setRestoredWalletAuthenticationIfUnlocked(context, restoredAuthenticationRead.state)) authentication = restoredAuthenticationRead.state;
-			break;
-		case "missing": break;
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("[WalletSession] Wallet Session authorization requires a newer client");
-	}
-	const capabilityProjection = buildWalletSessionCapabilityProjection({
-		subjectSet: authentication.kind === "authenticated" && restoredAuthenticationRead.kind === "authenticated" ? scopeSubjectSetToWalletAuthMethod(readResolution.subjectSet, restoredAuthenticationRead.walletAuthMethodId) : readResolution.subjectSet,
-		availableLanes,
-		configuredEcdsaTargets: listConfiguredThresholdEcdsaPublicationTargets(context.configs.network.chains).map((target) => target.chainTarget)
-	});
-	return {
-		appIdentity,
-		authentication,
-		capabilityProjection,
-		nonceDiagnostics: readWalletSessionNonceDiagnostics(context, appIdentity.nearAccountId)
-	};
-}
-function scopeSubjectSetToWalletAuthMethod(subjectSet, walletAuthMethodId) {
-	const [first, ...rest] = subjectSet.subjects.filter((subject) => subject.kind !== "evm_family_ecdsa_wallet" || String(subject.authority.walletAuthMethodId) === String(walletAuthMethodId));
-	if (!first) return subjectSet;
-	return {
-		...subjectSet,
-		subjects: [first, ...rest]
-	};
-}
-/**
-* A restore read races the user's lock: the read observes an unlocked
-* selection, the lock lands while its network validation runs, and the stale
-* result would re-authenticate a wallet the user just locked. Re-checking the
-* durable lock right before the runtime write keeps the lock decisive over
-* any in-flight restore.
-*/
-async function setRestoredWalletAuthenticationIfUnlocked(context, state) {
-	let lockedOut = false;
-	try {
-		const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(state.walletId));
-		lockedOut = selected.kind !== "resolved" || selected.selection.lockState !== "unlocked";
-	} catch {
-		lockedOut = true;
-	}
-	if (lockedOut) return false;
-	context.signingEngine.setWalletAuthenticated(state);
-	return true;
-}
-async function buildCapabilityUnresolvableWalletSession(args) {
-	const [appIdentity, exactAuthenticationRead] = await Promise.all([resolveWalletSessionAppIdentityForWallet(args.context, args.walletId), readExactWalletSessionAuthentication({
-		walletId: args.walletId,
-		ports: browserExactWalletSessionReadPorts
-	})]);
-	let authentication = { kind: "signed_out" };
-	switch (exactAuthenticationRead.kind) {
-		case "authenticated":
-			if (await setRestoredWalletAuthenticationIfUnlocked(args.context, exactAuthenticationRead.state)) authentication = exactAuthenticationRead.state;
-			break;
-		case "missing": break;
-		case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("[WalletSession] Wallet Session authorization requires a newer client");
-	}
-	return {
-		appIdentity,
-		authentication,
-		capabilityProjection: {
-			kind: "unresolvable",
-			reason: args.reason
-		},
-		nonceDiagnostics: readWalletSessionNonceDiagnostics(args.context, appIdentity.nearAccountId)
-	};
-}
-function readExactWalletSessionAvailableLanes(context, walletId) {
-	return context.signingEngine.readPersistedAvailableSigningLanes({ walletId }).then((lanes) => ({
-		kind: "available",
-		lanes
-	})).catch(() => ({ kind: "unavailable" }));
-}
-function readWalletSessionNonceDiagnostics(context, nearAccountId) {
-	const accountId = String(nearAccountId || "").trim();
-	if (!accountId) return null;
-	try {
-		return context.signingEngine.getNonceCoordinator().getDiagnostics({
-			accountId,
-			emitMetrics: true
-		});
-	} catch {
-		return null;
-	}
-}
-function normalizeEvmOwnerAddress(value) {
-	const candidate = String(value || "").trim().toLowerCase();
-	return /^0x[0-9a-f]{40}$/.test(candidate) ? candidate : "";
-}
-async function readProfileContinuityThresholdEcdsaWalletKeys(context, walletId) {
-	const configuredTargets = listConfiguredThresholdEcdsaPublicationTargets(context.configs.network.chains).map((target) => target.chainTarget);
-	if (!configuredTargets.length) return [];
-	const walletSigners = await IndexedDBManager.listAccountSignersByProfile({
-		profileId: String(walletId),
-		status: "active"
-	}).catch(() => []);
-	const walletKeys = [];
-	for (const signer of walletSigners) {
-		const parsed = parseActiveEcdsaSignerRecordForUnlock({
-			walletId,
-			configuredTargets,
-			signer
-		});
-		if (parsed.kind === "active_ecdsa_signer_record") walletKeys.push(parsed.walletKey);
-	}
-	return walletKeys;
-}
-async function resolveProfileContinuityThresholdEcdsaEthereumAddress(context, walletId) {
-	const addresses = [...new Set((await readProfileContinuityThresholdEcdsaWalletKeys(context, walletId)).map((walletKey) => normalizeEvmOwnerAddress(walletKey.keyFacts.thresholdOwnerAddress)).filter(Boolean))];
-	if (addresses.length === 1) return addresses[0];
-	if (addresses.length > 1) console.warn("[WalletSession] conflicting profile threshold ECDSA addresses", {
-		walletId: String(walletId),
-		addresses
-	});
-	return null;
-}
-function resolveThresholdLoginWarmSigners(args) {
-	if (args.selection.mode === "ed25519_only") return ["ed25519"];
-	if (!args.configuredEcdsaTargets.length) return args.selection.mode === "ecdsa_only" ? [] : ["ed25519"];
-	const keyIdsByTarget = new Set((args.canonicalEcdsaContext?.ecdsaKeys || []).map((key) => key.targetKey));
-	if (keyIdsByTarget.size === 0) throw new Error("[login] threshold ECDSA warm-up missing canonical key identity");
-	const missingTargets = args.configuredEcdsaTargets.map((target) => thresholdEcdsaChainTargetKey(target.chainTarget)).filter((targetKey) => !keyIdsByTarget.has(targetKey));
-	if (missingTargets.length) throw new Error(`[login] threshold ECDSA warm-up missing configured-target key ids for ${missingTargets.join(", ")}`);
-	return args.selection.mode === "ecdsa_only" ? ["ecdsa"] : ["ed25519", "ecdsa"];
-}
-function resolveThresholdLoginWarmupPlan(args) {
-	const configuredTargetKeyCompletion = buildConfiguredTargetKeyCompletion({
-		context: args.storedCanonicalEcdsaContext,
-		configuredTargets: args.selectedEcdsaTargets
-	});
-	const ecdsaContext = requireCompleteConfiguredTargetKeyContext({
-		completion: configuredTargetKeyCompletion,
-		source: "stored ECDSA key facts"
-	});
-	let signersToWarm = resolveThresholdLoginWarmSigners({
-		selection: args.selection,
-		configuredEcdsaTargets: args.selectedEcdsaTargets,
-		canonicalEcdsaContext: ecdsaContext
-	});
-	if (args.wantsEd25519Warmup && !signersToWarm.includes("ed25519")) signersToWarm = ["ed25519", ...signersToWarm];
-	const ed25519DependsOnEcdsa = false;
-	const ecdsaDependsOnEd25519 = signersToWarm.includes("ed25519") && signersToWarm.includes("ecdsa");
-	if (!signersToWarm.length) throw new Error("[login] ECDSA unlock requested with no configured ECDSA targets");
-	return {
-		kind: "threshold_login_warmup_plan_ready",
-		storedCanonicalEcdsaContext: args.storedCanonicalEcdsaContext,
-		configuredTargetKeyCompletion,
-		ecdsaContext,
-		signersToWarm,
-		ed25519DependsOnEcdsa,
-		ecdsaDependsOnEd25519
-	};
-}
-function createThresholdLoginWarmSessionId(prefix) {
-	return secureRandomId(prefix, 32, "threshold login warm session IDs");
-}
-function requireThresholdLoginEcdsaSessionId(value) {
-	const parsed = parseThresholdEcdsaSessionId(value);
-	if (!parsed.ok) throw new Error("[login] failed to create threshold ECDSA session identity");
-	return parsed.value;
-}
-function requireThresholdLoginWalletSessionMintId(value) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error("[login] failed to create Wallet Session mint identity");
-	return parsed.value;
-}
-function requireLoginUnlockSessionUses(remainingUses) {
-	if (remainingUses == null || remainingUses <= 0) throw new Error("[login] unlock warm-up requires positive unlock session uses");
-	return remainingUses;
-}
-function createThresholdEcdsaDeviceLinkRequiredError(targetKey) {
-	const error = /* @__PURE__ */ new Error(`[login] device_link_required: local threshold ECDSA material is unavailable for ${targetKey}`);
-	error.code = "device_link_required";
-	return error;
-}
-function createThresholdEd25519DeviceLinkRequiredError() {
-	const error = /* @__PURE__ */ new Error("[login] device_link_required: local threshold Ed25519 material is unavailable");
-	error.code = "device_link_required";
-	return error;
-}
-function resolveThresholdLoginWarmEcdsaThresholdSessionId(input) {
-	const current = String(input.sharedState.generatedThresholdSessionId || "").trim();
-	if (current) return current;
-	const generated = createThresholdLoginWarmSessionId("threshold-ecdsa-login");
-	input.sharedState.generatedThresholdSessionId = generated;
-	return generated;
-}
-async function resolveWalletEcdsaKeyFactsInventoryWithWebAuthn(args) {
-	if (!args.collectCredential) throw new Error("[login] WebAuthn ECDSA key-facts inventory requires a credential collector");
-	const serverNonceB64u = createLocalUnlockChallengeB64u();
-	const expectedChallengeDigestB64u = await computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u({
-		walletId: args.walletId,
-		rpId: args.rpId,
-		keyTargets: args.keyTargets,
-		serverNonceB64u,
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {}
-	});
-	const credential = await args.collectCredential(expectedChallengeDigestB64u);
-	return await fetchWalletEcdsaKeyFactsInventoryWithWebAuthn({
-		relayerUrl: args.relayerUrl,
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credential,
-		keyTargets: args.keyTargets,
-		serverNonceB64u,
-		expectedChallengeDigestB64u,
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {}
-	});
-}
-async function resolveWalletEcdsaKeyFactsInventoryForLogin(args) {
-	const relayerUrl = String(args.relayerUrl || "").trim();
-	const rpId = String(args.rpId || "").trim();
-	if (!relayerUrl || !rpId) throw new Error("[login] threshold ECDSA key-facts inventory requires relayerUrl and rpId");
-	if (args.authority?.kind === "wallet_session_operation_credential_v1") return await fetchWalletEcdsaKeyFactsInventoryWithOperationCredential({
-		relayerUrl,
-		walletId: args.walletId,
-		rpId,
-		operationCredential: args.authority.operationCredential,
-		keyTargets: args.keyTargets
-	});
-	return await resolveWalletEcdsaKeyFactsInventoryWithWebAuthn({
-		walletId: args.walletId,
-		relayerUrl,
-		rpId,
-		keyTargets: args.keyTargets,
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {},
-		collectCredential: args.collectWebAuthnInventoryCredential
-	});
-}
-function authenticatedInventorySignerMatch(args) {
-	const parsed = parseActiveEcdsaSignerRecordForUnlock({
-		walletId: args.walletId,
-		configuredTargets: args.configuredTargets,
-		signer: args.signer
-	});
-	switch (parsed.kind) {
-		case "active_ecdsa_signer_record": return parsed.targetKey === thresholdEcdsaChainTargetKey(args.record.walletKey.chainTarget) && String(parsed.walletKey.keyHandle) === String(args.record.walletKey.keyHandle);
-		case "key_facts_inventory_required": return parsed.targetKey === thresholdEcdsaChainTargetKey(args.record.walletKey.chainTarget) && parsed.keyHandle === String(args.record.walletKey.keyHandle);
-		case "blocked":
-		case "skipped": return false;
-	}
-	return false;
-}
-function repairedEcdsaSignerMetadata(args) {
-	const walletKey = args.record.walletKey;
-	const keyFacts = walletKey.keyFacts;
-	const targetKey = thresholdEcdsaChainTargetKey(walletKey.chainTarget);
-	return {
-		...args.signer.metadata || {},
-		accountModel: "threshold-ecdsa",
-		accountAddress: args.record.accountAddress,
-		ownerAddress: args.record.ownerAddress,
-		thresholdOwnerAddress: keyFacts.thresholdOwnerAddress,
-		keyScope: keyFacts.keyScope,
-		keyHandle: walletKey.keyHandle,
-		walletId: walletKey.walletId,
-		ecdsaThresholdKeyId: keyFacts.ecdsaThresholdKeyId,
-		signingRootId: keyFacts.signingRootId,
-		signingRootVersion: keyFacts.signingRootVersion,
-		publicCapability: args.record.publicCapability,
-		thresholdEcdsaPublicKeyB64u: keyFacts.thresholdEcdsaPublicKeyB64u,
-		participantIds: [...keyFacts.participantIds],
-		chainTarget: walletKey.chainTarget,
-		targetMembership: {
-			targetKey,
-			chainTarget: walletKey.chainTarget
-		},
-		sharedEvmFamilyKey: {
-			walletId: walletKey.walletId,
-			keyScope: keyFacts.keyScope,
-			keyHandle: walletKey.keyHandle,
-			ecdsaThresholdKeyId: keyFacts.ecdsaThresholdKeyId,
-			signingRootId: keyFacts.signingRootId,
-			signingRootVersion: keyFacts.signingRootVersion,
-			participantIds: [...keyFacts.participantIds],
-			thresholdOwnerAddress: keyFacts.thresholdOwnerAddress,
-			thresholdEcdsaPublicKeyB64u: keyFacts.thresholdEcdsaPublicKeyB64u
-		},
-		chainId: walletKey.chainTarget.chainId
-	};
-}
-async function persistAuthenticatedEcdsaInventoryProfileRepairs(args) {
-	for (const record of args.records) {
-		const matchingSigners = args.walletSigners.filter((signer) => authenticatedInventorySignerMatch({
-			walletId: args.walletId,
-			configuredTargets: args.configuredTargets,
-			signer,
-			record
-		}));
-		if (matchingSigners.length !== 1) throw new Error(`[login] authenticated ECDSA key inventory could not identify one profile signer for ${thresholdEcdsaChainTargetKey(record.walletKey.chainTarget)}`);
-		const signer = matchingSigners[0];
-		if (String(record.walletKey.walletId) !== String(args.walletId) || record.accountAddress !== signer.accountAddress || record.ownerAddress !== signer.accountAddress || String(record.walletKey.keyFacts.thresholdOwnerAddress) !== signer.accountAddress) throw new Error(`[login] authenticated ECDSA key inventory profile identity mismatch for ${thresholdEcdsaChainTargetKey(record.walletKey.chainTarget)}`);
-		await args.store.activateAccountSigner({
-			account: {
-				profileId: signer.profileId,
-				chainIdKey: signer.chainIdKey,
-				accountAddress: signer.accountAddress,
-				accountModel: "threshold-ecdsa"
-			},
-			signer: {
-				signerId: signer.signerId,
-				signerType: signer.signerType,
-				signerKind: signer.signerKind,
-				signerAuthMethod: signer.signerAuthMethod,
-				signerSource: signer.signerSource,
-				metadata: repairedEcdsaSignerMetadata({
-					signer,
-					record
-				})
-			},
-			activationPolicy: { mode: "allocate_next_free" },
-			preferredSlot: signer.signerSlot,
-			selectAsActive: false,
-			mutation: { routeThroughOutbox: false }
-		});
-	}
-}
-function buildCanonicalThresholdEcdsaWarmSessionContext(ecdsaKeys, runtimePolicyScope) {
-	if (runtimePolicyScope) return {
-		ecdsaKeys,
-		runtimePolicyScope
-	};
-	return { ecdsaKeys };
-}
-function buildProfileContinuityEcdsaInventoryInput(args) {
-	const keyFactsInventoryAuthority = args.input?.keyFactsInventoryAuthority || null;
-	const keyFactsInventoryRequested = args.input?.keyFactsInventoryRequested === true;
-	const relayerUrl = args.input?.relayerUrl || "";
-	const rpId = args.input?.rpId || "";
-	const collectWebAuthnInventoryCredential = args.input?.collectWebAuthnInventoryCredential;
-	if (args.runtimePolicyScope) return {
-		kind: "runtime_policy_scoped",
-		keyFactsInventoryAuthority,
-		keyFactsInventoryRequested,
-		relayerUrl,
-		rpId,
-		runtimePolicyScope: args.runtimePolicyScope,
-		collectWebAuthnInventoryCredential
-	};
-	return {
-		kind: "runtime_policy_unscoped",
-		keyFactsInventoryAuthority,
-		keyFactsInventoryRequested,
-		relayerUrl,
-		rpId,
-		collectWebAuthnInventoryCredential
-	};
-}
-async function resolveProfileContinuityEcdsaWarmKeys(walletId, configuredTargets, keyFactsInventoryInput) {
-	const configuredChainTargets = configuredTargets.map((target) => target.chainTarget);
-	const walletSigners = await IndexedDBManager.listAccountSignersByProfile({
-		profileId: String(walletId),
-		status: "active"
-	}).catch(() => []);
-	const activeSignerRecords = [];
-	const keyFactsInventoryRequiredRecords = [];
-	const blockedRecords = [];
-	for (const signer of walletSigners) {
-		const parsed = parseActiveEcdsaSignerRecordForUnlock({
-			walletId,
-			configuredTargets: configuredChainTargets,
-			signer
-		});
-		switch (parsed.kind) {
-			case "active_ecdsa_signer_record":
-				activeSignerRecords.push(parsed);
-				break;
-			case "key_facts_inventory_required":
-				keyFactsInventoryRequiredRecords.push(parsed);
-				break;
-			case "blocked":
-				blockedRecords.push(parsed);
-				break;
-			case "skipped": break;
-			default:
-		}
-	}
-	if (!activeSignerRecords.length && !keyFactsInventoryRequiredRecords.length && !blockedRecords.length) return [];
-	const plan = planUnlockEcdsaWarmup({
-		selection: {
-			mode: "ecdsa_only",
-			ecdsa: true
-		},
-		configuredTargets: configuredChainTargets,
-		activeSignerRecords,
-		keyFactsInventoryRequiredRecords,
-		blockedRecords,
-		runtimeConfig: {
-			explicitKeyFactsInventoryMode: keyFactsInventoryInput?.keyFactsInventoryRequested === true,
-			allowAuthenticatedKeyFactsInventory: Boolean(keyFactsInventoryInput?.keyFactsInventoryAuthority)
-		}
-	});
-	switch (plan.kind) {
-		case "ready": {
-			const missingCapabilityTargets = plan.readyTargets.filter((target) => target.publicCapability.kind === "missing_public_capability");
-			const repairedCapabilities = /* @__PURE__ */ new Map();
-			let repairedInventoryRecords = [];
-			if (missingCapabilityTargets.length) {
-				const inventory = await resolveWalletEcdsaKeyFactsInventoryForLogin({
-					walletId,
-					relayerUrl: keyFactsInventoryInput?.relayerUrl || "",
-					rpId: keyFactsInventoryInput?.rpId || "",
-					keyTargets: missingCapabilityTargets.map((target) => ({
-						keyHandle: target.walletKey.keyHandle,
-						chainTarget: target.chainTarget
-					})),
-					authority: keyFactsInventoryInput?.keyFactsInventoryAuthority || null,
-					...keyFactsInventoryInput?.runtimePolicyScope ? { runtimePolicyScope: keyFactsInventoryInput.runtimePolicyScope } : {},
-					collectWebAuthnInventoryCredential: keyFactsInventoryInput?.collectWebAuthnInventoryCredential
-				});
-				repairedInventoryRecords = inventory.records;
-				for (const record of inventory.records) repairedCapabilities.set(thresholdEcdsaChainTargetKey(record.walletKey.chainTarget), record.publicCapability);
-			}
-			const canonicalKeys = collectConfiguredTargetThresholdEcdsaWarmKeys({
-				source: "profile continuity",
-				keys: plan.readyTargets.map((target) => configuredTargetThresholdEcdsaWarmKey({
-					chainTarget: target.chainTarget,
-					keyHandle: target.walletKey.keyHandle,
-					key: evmFamilyEcdsaWalletKeyToIdentity(target.walletKey),
-					publicCapability: target.publicCapability.kind === "persisted_public_capability" ? target.publicCapability.value : repairedCapabilities.get(target.targetKey)
-				}))
-			});
-			const unresolvedCapabilities = canonicalKeys.filter((key) => key.publicCapability.kind === "missing_public_capability").map((key) => key.targetKey);
-			if (unresolvedCapabilities.length) throw new Error(`[login] authenticated ECDSA key inventory did not return public capabilities for ${unresolvedCapabilities.join(", ")}`);
-			await persistAuthenticatedEcdsaInventoryProfileRepairs({
-				store: IndexedDBManager,
-				walletId,
-				configuredTargets: configuredChainTargets,
-				walletSigners,
-				records: repairedInventoryRecords
-			});
-			return canonicalKeys;
-		}
-		case "no_configured_ecdsa_targets": return [];
-		case "awaiting_authenticated_key_facts_inventory": {
-			const keyFactsInventoryAuthority = keyFactsInventoryInput?.keyFactsInventoryAuthority;
-			if (!keyFactsInventoryAuthority) throw new Error("[login] threshold ECDSA key-facts inventory requires authenticated inventory authority");
-			const inventory = await resolveWalletEcdsaKeyFactsInventoryForLogin({
-				walletId,
-				relayerUrl: keyFactsInventoryInput.relayerUrl,
-				rpId: keyFactsInventoryInput.rpId,
-				keyTargets: plan.keyTargets,
-				authority: keyFactsInventoryAuthority,
-				...keyFactsInventoryInput.runtimePolicyScope ? { runtimePolicyScope: keyFactsInventoryInput.runtimePolicyScope } : {},
-				collectWebAuthnInventoryCredential: keyFactsInventoryInput.collectWebAuthnInventoryCredential
-			});
-			const inventoriedCompletion = buildConfiguredTargetKeyCompletion({
-				context: { ecdsaKeys: collectConfiguredTargetThresholdEcdsaWarmKeys({
-					source: "profile continuity inventory",
-					keys: inventory.records.map((record) => configuredTargetThresholdEcdsaWarmKey({
-						chainTarget: record.walletKey.chainTarget,
-						keyHandle: record.walletKey.keyHandle,
-						key: evmFamilyEcdsaWalletKeyToIdentity(record.walletKey),
-						publicCapability: record.publicCapability
-					}))
-				}) },
-				configuredTargets
-			});
-			if (inventoriedCompletion.kind !== "complete_configured_target_keys") throw new Error("[login] threshold ECDSA key-facts inventory returned incomplete key facts");
-			await persistAuthenticatedEcdsaInventoryProfileRepairs({
-				store: IndexedDBManager,
-				walletId,
-				configuredTargets: configuredChainTargets,
-				walletSigners,
-				records: inventory.records
-			});
-			return inventoriedCompletion.context.ecdsaKeys;
-		}
-		case "key_facts_inventory_required": {
-			const targets = plan.keyFactsInventoryRequiredRecords.map((record) => record.targetKey).join(", ");
-			if (keyFactsInventoryInput?.keyFactsInventoryRequested) throw new Error(`[login] threshold ECDSA key-facts inventory requires authenticated inventory authority for ${targets}`);
-			throw new Error(`[login] threshold ECDSA warm-up requires complete local key facts for ${targets}; run explicit authenticated ECDSA key-facts inventory before unlock`);
-		}
-		case "blocked": {
-			const reasons = plan.blockedRecords.map((record) => `${record.targetKey || "unknown"}:${record.reason}`).join(", ");
-			throw new Error(`[login] threshold ECDSA warm-up requires complete local key facts before unlock; run explicit authenticated ECDSA key-facts inventory before unlock; blocked profile signer records: ${reasons}`);
-		}
-	}
-	return [];
-}
-async function resolveCanonicalThresholdEcdsaWarmSessionContext(context, walletId, keyFactsInventoryInput, authMethod) {
-	const configuredTargets = listConfiguredThresholdEcdsaPublicationTargets(context.configs.network.chains);
-	const storedKeys = [];
-	let runtimePolicyScope;
-	let canonicalContext = buildCanonicalThresholdEcdsaWarmSessionContext(collectConfiguredTargetThresholdEcdsaWarmKeys({
-		source: "stored",
-		keys: storedKeys
-	}), runtimePolicyScope);
-	const capabilities = await listBrowserCanonicalEcdsaSigningCapabilitiesForWallet({
-		walletId,
-		chainTargets: configuredTargets.map((target) => target.chainTarget),
-		...authMethod ? { authMethod } : {}
-	});
-	const availableLaneKeys = [];
-	let availableLaneRuntimePolicyScope;
-	for (const capability of capabilities) {
-		const manifest = capability.manifest;
-		for (const { chainTarget: target } of configuredTargets) {
-			if (!manifest.signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetKey(membership) === thresholdEcdsaChainTargetKey(target))) continue;
-			const publicFacts = manifest.durableMaterial.roleLocalPublicFacts;
-			const keyHandle = String(publicFacts.keyHandle);
-			const publicCapability = publicFacts.publicCapability;
-			const existingRoleLocalMaterial = capability.material;
-			const laneRuntimePolicyScope = manifest.durableMaterial.runtimePolicyScope;
-			const signingRootBinding = resolveThresholdSigningRootBindingFromRuntimePolicyScope({ runtimePolicyScope: laneRuntimePolicyScope });
-			if (String(signingRootBinding.signingRootId) !== String(manifest.signer.signingRootId) || String(signingRootBinding.signingRootVersion) !== String(manifest.signer.signingRootVersion)) throw new Error(`[login] threshold ECDSA canonical runtime policy scope mismatch for ${thresholdEcdsaChainTargetKey(target)}`);
-			if (availableLaneRuntimePolicyScope && laneRuntimePolicyScope && !sameThresholdRuntimePolicyScope(availableLaneRuntimePolicyScope, laneRuntimePolicyScope)) throw new Error("[login] threshold ECDSA durable lanes have conflicting runtime policy scopes");
-			if (!availableLaneRuntimePolicyScope && laneRuntimePolicyScope) availableLaneRuntimePolicyScope = laneRuntimePolicyScope;
-			availableLaneKeys.push(configuredTargetThresholdEcdsaWarmKey({
-				chainTarget: target,
-				keyHandle,
-				key: buildBaseEvmFamilyEcdsaKeyIdentity({
-					walletId: manifest.signer.walletId,
-					ecdsaThresholdKeyId: manifest.durableMaterial.roleLocalBinding.ecdsaThresholdKeyId,
-					signingRootId: manifest.signer.signingRootId,
-					signingRootVersion: manifest.signer.signingRootVersion,
-					participantIds: manifest.signer.registeredPublicFacts.participantIds,
-					thresholdOwnerAddress: manifest.signer.registeredPublicFacts.thresholdOwnerAddress
-				}),
-				publicCapability,
-				existingRoleLocalMaterial
-			}));
-		}
-	}
-	const exactAvailableLaneKeys = collectConfiguredTargetThresholdEcdsaWarmKeys({
-		source: "available lane",
-		keys: availableLaneKeys
-	});
-	canonicalContext = mergeThresholdEcdsaWarmSessionContexts({
-		current: canonicalContext,
-		incoming: buildCanonicalThresholdEcdsaWarmSessionContext(exactAvailableLaneKeys, availableLaneRuntimePolicyScope),
-		source: "durable lanes"
-	});
-	const configuredTargetCompletion = buildConfiguredTargetKeyCompletion({
-		context: canonicalContext,
-		configuredTargets
-	});
-	if (configuredTargetCompletion.kind === "complete_configured_target_keys") return configuredTargetCompletion.context;
-	const missingTargets = new Set(configuredTargetCompletion.missingTargets);
-	const profileEcdsaThresholdKeys = await resolveProfileContinuityEcdsaWarmKeys(walletId, configuredTargets.filter((target) => missingTargets.has(thresholdEcdsaChainTargetKey(target.chainTarget))), buildProfileContinuityEcdsaInventoryInput({
-		input: keyFactsInventoryInput,
-		runtimePolicyScope: canonicalContext.runtimePolicyScope
-	}));
-	canonicalContext = mergeThresholdEcdsaWarmSessionContexts({
-		current: canonicalContext,
-		incoming: { ecdsaKeys: profileEcdsaThresholdKeys },
-		source: "profile continuity"
-	});
-	return canonicalContext;
-}
-async function resolveProfileContinuityThresholdEcdsaPublicKeyB64u(context, walletId) {
-	const publicKeys = [...new Set((await readProfileContinuityThresholdEcdsaWalletKeys(context, walletId)).map((walletKey) => String(walletKey.keyFacts.thresholdEcdsaPublicKeyB64u || "").trim()).filter(Boolean))];
-	if (publicKeys.length === 1) return publicKeys[0];
-	if (publicKeys.length > 1) console.warn("[WalletSession] conflicting profile threshold ECDSA public keys", {
-		walletId: String(walletId),
-		publicKeyCount: publicKeys.length
-	});
-	return null;
-}
-async function resolveThresholdEcdsaLoginMetadata(context, walletId) {
-	const [profileAddress, profilePublicKey] = await Promise.all([resolveProfileContinuityThresholdEcdsaEthereumAddress(context, walletId), resolveProfileContinuityThresholdEcdsaPublicKeyB64u(context, walletId)]);
-	if (profileAddress && profilePublicKey) return {
-		ethereumAddress: profileAddress,
-		thresholdEcdsaPublicKeyB64u: profilePublicKey
-	};
-	const capabilities = await listBrowserCanonicalEcdsaSigningCapabilitiesForWallet({
-		walletId,
-		chainTargets: listConfiguredThresholdEcdsaPublicationTargets(context.configs.network.chains).map((target) => target.chainTarget)
-	});
-	const addresses = /* @__PURE__ */ new Set();
-	const publicKeys = /* @__PURE__ */ new Set();
-	for (const capability of capabilities) {
-		const facts = capability.manifest.signer.registeredPublicFacts;
-		addresses.add(normalizeEvmOwnerAddress(facts.thresholdOwnerAddress));
-		publicKeys.add(facts.publicKeyB64u);
-	}
-	return {
-		ethereumAddress: profileAddress ?? (addresses.size === 1 ? [...addresses][0] : null),
-		thresholdEcdsaPublicKeyB64u: profilePublicKey ?? (publicKeys.size === 1 ? [...publicKeys][0] : null)
-	};
-}
-function failedCapabilityLane(reason) {
-	return {
-		kind: "failed",
-		reason
-	};
-}
-function persistenceUnavailableCapabilityLane() {
-	return {
-		kind: "failed",
-		reason: "persistence_unavailable"
-	};
-}
-function parseExactAvailableLaneReadiness(lane) {
-	switch (lane.state) {
-		case "ready": return { kind: "ready" };
-		case "restorable": return {
-			kind: "pending",
-			resume: "restore_material"
-		};
-		case "deferred": return {
-			kind: "pending",
-			resume: "resolve_deferred_state"
-		};
-		case "expired": return {
-			kind: "authorization_required",
-			requirement: "wallet_session_expired"
-		};
-		case "exhausted": return {
-			kind: "authorization_required",
-			requirement: "wallet_session_exhausted"
-		};
-	}
-	throw new Error("[SeamsWeb] unsupported capability lane readiness");
-}
-function invalidLaneReasonForCurve(snapshot, curve) {
-	const diagnostic = snapshot.diagnostics?.invalidLanes.find((candidate) => candidate.curve === curve);
-	if (!diagnostic) return null;
-	return diagnostic.reason === "ambiguous_material" || diagnostic.reason === "conflicting_key_material" ? "ambiguous_lane" : "malformed";
-}
-function invalidEcdsaLaneReasonForTarget(snapshot, chainTarget) {
-	const targetKey = thresholdEcdsaChainTargetKey(chainTarget);
-	const diagnostic = snapshot.diagnostics?.invalidLanes.find((candidate) => candidate.curve === "ecdsa" && (candidate.targetKey === void 0 || candidate.targetKey === targetKey));
-	if (!diagnostic) return null;
-	return diagnostic.reason === "ambiguous_material" || diagnostic.reason === "conflicting_key_material" ? "ambiguous_lane" : "malformed";
-}
-function nearSubjectMatchesLane(subject, lane) {
-	return String(lane.walletId) === String(subject.walletId) && String(lane.nearAccountId) === String(subject.nearAccountId) && String(lane.nearEd25519SigningKeyId) === String(subject.nearEd25519SigningKeyId) && lane.signerSlot === subject.signerSlot;
-}
-function ecdsaSubjectMatchesLane(subject, lane) {
-	return String(lane.key.walletId) === String(subject.walletId) && String(lane.key.ecdsaThresholdKeyId) === String(subject.ecdsaThresholdKeyId);
-}
-function nearCapabilityReadiness(args) {
-	if (args.availableLanes.kind === "unavailable") return {
-		kind: "near_ed25519",
-		subject: args.subject,
-		lane: persistenceUnavailableCapabilityLane()
-	};
-	const snapshot = args.availableLanes.lanes;
-	if (String(snapshot.walletId) !== String(args.subject.walletId)) return {
-		kind: "near_ed25519",
-		subject: args.subject,
-		lane: failedCapabilityLane("identity_mismatch")
-	};
-	const invalidReason = invalidLaneReasonForCurve(snapshot, "ed25519");
-	if (invalidReason) return {
-		kind: "near_ed25519",
-		subject: args.subject,
-		lane: failedCapabilityLane(invalidReason)
-	};
-	const lane = snapshot.lanes.ed25519.near;
-	if (!isConcreteAvailableSigningLane(lane)) return {
-		kind: "near_ed25519",
-		subject: args.subject,
-		lane: failedCapabilityLane("missing")
-	};
-	return {
-		kind: "near_ed25519",
-		subject: args.subject,
-		lane: nearSubjectMatchesLane(args.subject, lane) ? parseExactAvailableLaneReadiness(lane) : failedCapabilityLane("identity_mismatch")
-	};
-}
-function ecdsaCapabilityLaneReadinessForTarget(args) {
-	if (args.availableLanes.kind === "unavailable") return persistenceUnavailableCapabilityLane();
-	const snapshot = args.availableLanes.lanes;
-	if (String(snapshot.walletId) !== String(args.subject.walletId)) return failedCapabilityLane("identity_mismatch");
-	const invalidReason = invalidEcdsaLaneReasonForTarget(snapshot, args.chainTarget);
-	if (invalidReason) return failedCapabilityLane(invalidReason);
-	const lane = ecdsaAvailableLaneForTarget(snapshot, args.chainTarget);
-	if (!isConcreteAvailableSigningLane(lane)) return failedCapabilityLane("missing");
-	if (!ecdsaSubjectMatchesLane(args.subject, lane)) return failedCapabilityLane("identity_mismatch");
-	if (lane.source === "canonical_capability" && !lane.authorization) return {
-		kind: "authorization_required",
-		requirement: "same_method_step_up"
-	};
-	return parseExactAvailableLaneReadiness(lane);
-}
-function ecdsaCapabilityReadiness(args) {
-	const [firstTarget, ...remainingTargets] = args.configuredTargets;
-	if (!firstTarget) return {
-		kind: "evm_family_ecdsa",
-		subject: args.subject,
-		targets: { kind: "no_configured_target" }
-	};
-	return {
-		kind: "evm_family_ecdsa",
-		subject: args.subject,
-		targets: {
-			kind: "configured_targets",
-			lanes: [{
-				chainTarget: firstTarget,
-				readiness: ecdsaCapabilityLaneReadinessForTarget({
-					subject: args.subject,
-					availableLanes: args.availableLanes,
-					chainTarget: firstTarget
-				})
-			}, ...remainingTargets.map((chainTarget) => ({
-				chainTarget,
-				readiness: ecdsaCapabilityLaneReadinessForTarget({
-					subject: args.subject,
-					availableLanes: args.availableLanes,
-					chainTarget
-				})
-			}))]
-		}
-	};
-}
-function buildWalletSessionCapabilityProjection(args) {
-	const capabilities = args.subjectSet.subjects.map((subject) => {
-		switch (subject.kind) {
-			case "near_ed25519_wallet": return nearCapabilityReadiness({
-				subject,
-				availableLanes: args.availableLanes
-			});
-			case "evm_family_ecdsa_wallet": return ecdsaCapabilityReadiness({
-				subject,
-				availableLanes: args.availableLanes,
-				configuredTargets: args.configuredEcdsaTargets
-			});
-		}
-		return assertNeverLoginState(subject);
-	});
-	const firstCapability = capabilities[0];
-	if (!firstCapability) throw new Error("[WalletSession] resolved capability subjects must be non-empty");
-	return {
-		kind: "resolved",
-		subjectSet: args.subjectSet,
-		capabilities: [firstCapability, ...capabilities.slice(1)]
-	};
-}
-function selectNearOperationalPublicKeyForLogin(userData) {
-	return userData ? userData.operationalPublicKey : null;
-}
-function userMatchesNearWalletSubject(user, subject) {
-	return Boolean(user && String(user.walletId) === String(subject.walletId) && String(user.nearAccountId) === String(subject.nearAccountId) && user.signerSlot === subject.signerSlot);
-}
-async function resolveExactNearWalletUser(signingEngine, subject) {
-	const lastUser = await signingEngine.getLastUser().catch(() => null);
-	if (userMatchesNearWalletSubject(lastUser, subject)) return lastUser;
-	const projected = await getNearAccountProjection(IndexedDBManager, subject.nearAccountId, subject.signerSlot).catch(() => null);
-	if (userMatchesNearWalletSubject(projected, subject)) return projected;
-	const stored = await signingEngine.getUserBySignerSlot(subject.nearAccountId, subject.signerSlot).catch(() => null);
-	return userMatchesNearWalletSubject(stored, subject) ? stored : null;
-}
-function nearWalletSubjectsEqual(left, right) {
-	return left.walletId === right.walletId && left.nearAccountId === right.nearAccountId && left.nearEd25519SigningKeyId === right.nearEd25519SigningKeyId && left.signerSlot === right.signerSlot;
-}
-async function resolveLinkedNearOperationalPublicKey(subject) {
-	const parsedWalletId = parseWalletId(String(subject.walletId));
-	if (!parsedWalletId.ok) return null;
-	const walletId = parsedWalletId.value;
-	let resolved;
-	try {
-		resolved = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return null;
-	}
-	if (resolved.kind !== "resolved") return null;
-	const { selection, authMethod, authority } = resolved;
-	if (linkedDeviceUnlockIdentityMismatchLabels({
-		walletId,
-		selection,
-		authMethod,
-		authority
-	}).length > 0 || authMethod.status !== "active" || authority.state !== "active" || authority.provenance.kind !== "device_link") return null;
-	const resolvedSubject = await resolveLinkedDeviceNearUnlockSubject({
-		walletId,
-		authMethod,
-		authority,
-		signerMaterials: resolved.signerMaterials
-	});
-	if (resolvedSubject.kind !== "resolved" || !nearWalletSubjectsEqual(resolvedSubject.subject, subject)) return null;
-	const activation = authority.signerActivations.ed25519;
-	if (!activation) return null;
-	return `ed25519:${base58Encode(base64UrlDecode(activation.signer.registeredPublicKeyB64u))}`;
-}
-async function resolveWalletSessionAppIdentityForWallet(context, walletId) {
-	const [authMethods, thresholdMetadata] = await Promise.all([readWalletAuthMethodBindingsForSession(walletId), resolveThresholdEcdsaLoginMetadata(context, walletId).catch(() => ({
-		ethereumAddress: null,
-		thresholdEcdsaPublicKeyB64u: null
-	}))]);
-	return {
-		kind: "resolved",
-		walletId,
-		nearAccountId: null,
-		nearOperationalPublicKey: null,
-		userData: null,
-		authMethods,
-		thresholdEcdsaEthereumAddress: thresholdMetadata.ethereumAddress,
-		thresholdEcdsaPublicKeyB64u: thresholdMetadata.thresholdEcdsaPublicKeyB64u
-	};
-}
-async function resolveWalletSessionAppIdentity(context, readResolution) {
-	const resolvedWalletId = readResolution.walletId;
-	const nearSubject = selectNearEd25519WalletSubject(readResolution.subjectSet);
-	const resolvedNearAccountId = nearSubject?.nearAccountId || null;
-	const [userData, base] = await Promise.all([nearSubject ? resolveExactNearWalletUser(context.signingEngine, nearSubject) : null, resolveWalletSessionAppIdentityForWallet(context, resolvedWalletId)]);
-	const nearOperationalPublicKey = selectNearOperationalPublicKeyForLogin(userData) || (nearSubject ? await resolveLinkedNearOperationalPublicKey(nearSubject) : null);
-	return {
-		...base,
-		nearAccountId: resolvedNearAccountId,
-		nearOperationalPublicKey,
-		userData
-	};
-}
-/**
-* List recently used accounts from IndexedDB.
-*
-* Used for account picker UIs and initial app bootstrap state.
-*/
-async function getRecentUnlocks(context) {
-	const [allUsersData, selections, lastUsedUser] = await Promise.all([
-		context.signingEngine.getAllUsers(),
-		IndexedDBManager.listWalletSelections(),
-		context.signingEngine.getLastUser()
-	]);
-	const linkedAccounts = (await Promise.all(selections.map(recentUnlockAccountFromLinkedDeviceSelection))).filter((account) => account !== null);
-	const accountsByWalletAuthMethod = /* @__PURE__ */ new Map();
-	for (const user of allUsersData) {
-		const account = recentUnlockAccountFromUser(user);
-		accountsByWalletAuthMethod.set(recentUnlockAccountKey(account), account);
-	}
-	for (const account of linkedAccounts) accountsByWalletAuthMethod.set(recentUnlockAccountKey(account), account);
-	const accounts = [...accountsByWalletAuthMethod.values()];
-	const walletIds = [...new Set([...accounts.map((account) => account.walletId), ...selections.map((selection) => String(selection.walletId))])];
-	const accountIds = [...new Set(accounts.map((account) => account.nearAccountId))];
-	const legacyLastUsedAccount = lastUsedUser ? recentUnlockAccountFromUser(lastUsedUser) : null;
-	return {
-		walletIds,
-		accountIds,
-		accounts,
-		lastUsedAccount: latestRecentUnlockAccount([...linkedAccounts, ...legacyLastUsedAccount ? [legacyLastUsedAccount] : []])
-	};
-}
-async function lock(context) {
-	const { signingEngine } = context;
-	const authentication = signingEngine.readWalletAuthenticationState();
-	let failure;
-	let failed = false;
-	let authenticationCleared = false;
-	if (authentication.kind === "authenticated") {
-		try {
-			await signingEngine.advanceWalletLockGeneration(authentication.walletId);
-		} catch (error) {
-			failure = error;
-			failed = true;
-		}
-		try {
-			await signingEngine.retireActiveWalletSessionAuthorizationForLock(authentication.walletId);
-		} catch (error) {
-			if (!failed) {
-				failure = error;
-				failed = true;
-			}
-		}
-	}
-	try {
-		authenticationCleared = signingEngine.clearWalletAuthenticationIfCurrent(authentication);
-	} catch (error) {
-		if (!failed) {
-			failure = error;
-			failed = true;
-		}
-	}
-	if (authenticationCleared) {
-		try {
-			signingEngine.getNonceCoordinator().clearAll();
-		} catch {}
-		try {
-			signingEngine.clearThresholdEcdsaSigningQueue();
-		} catch {}
-	}
-	try {
-		await signingEngine.clearVolatileWarmSigningMaterial(authentication.kind === "authenticated" ? authentication.walletId : void 0);
-	} catch (error) {
-		if (!failed) {
-			failure = error;
-			failed = true;
-		}
-	}
-	if (failed) throw failure;
-}
-async function logout(context) {
-	const authentication = context.signingEngine.readWalletAuthenticationState();
-	const cleanupTarget = authentication.kind === "authenticated" ? {
-		kind: "wallet",
-		walletId: authentication.walletId
-	} : null;
-	let failure;
-	let failed = false;
-	try {
-		await lock(context);
-	} catch (error) {
-		failure = error;
-		failed = true;
-	}
-	if (cleanupTarget) try {
-		await context.signingEngine.deleteDurableEcdsaPresignatures(cleanupTarget);
-	} catch (error) {
-		if (!failed) failure = error;
-		failed = true;
-	}
-	if (failed) throw failure;
-}
-async function resumeNearAfterSuccessfulUnlock(args) {
-	try {
-		await (await import("../registration/registration.js")).resumeNearRegistrationAfterUnlock(args);
-	} catch (error) {
-		console.warn("[login] NEAR continuation could not start", error instanceof Error ? error.message : "module unavailable");
-	} finally {
-		new Uint8Array(args.ownedFactorSecret).fill(0);
-	}
-}
-//#endregion
-export { activateLinkedDeviceSignerRuntimesAfterLink, getRecentUnlocks, getWalletSession, lock, logout, resolveExactLinkedEmailOtpAuthority, resolveLinkedDeviceEmailOtpAuthoritySelection, unlockLinkedDeviceEmailOtpWallet, unlockResolvedWalletSubjectSet };
-
-//# sourceMappingURL=login.js.map