@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/SeamsWeb/signingSurface/BrowserSigningSurface.js

@@ -1,3917 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionAuthorizationId, parseWalletSessionMintId } from "../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { sha256HexUtf8 } from "../../shared-ts/src/utils/digests.js";
-import { activeWalletSessionV1RecordsEqual } from "../../shared-ts/src/device-linking/activeWalletSession.js";
-import { WalletSessionStatusReadScope, createRelayerExactWalletSessionStatusPort } from "../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, SIGNING_SESSION_SEAL_GROUP_ID } from "../../shared-ts/src/utils/signingSessionSeal.js";
-import { base58Encode } from "../../shared-ts/src/utils/base58.js";
-import { toAccountId } from "../../core/types/accountIds.js";
-import { WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
-import { WALLET_AUTH_METHODS } from "../../shared-ts/src/utils/signerDomain.js";
-import { createNearProvisioningStateChangedEvent } from "../../core/types/sdkSentEvents.js";
-import { subscribeToNearProvisioning } from "../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
-import { nearEd25519SigningKeyIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
-import { toWalletId } from "../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { buildThresholdEd25519Participants2pV1 } from "../../shared-ts/src/threshold/participants.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../shared-ts/src/threshold/signingRootScope.js";
-import { SigningSessionIds } from "../../core/signingEngine/session/operationState/types.js";
-import { exactEd25519ExportMaterialIdentity } from "../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
-import { secureRandomId } from "../../shared-ts/src/utils/secureRandomId.js";
-import { DEFAULT_THRESHOLD_SESSION_POLICY, DEFAULT_UNLOCK_REMAINING_USES } from "../../core/signingEngine/threshold/sessionPolicy.js";
-import { parseSignerSlot } from "../../shared-ts/src/utils/signerSlot.js";
-import { publishEd25519YaoPublicCapabilityReferenceAndLane, readEmailOtpProviderSubjectForWalletV1 } from "../../core/signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
-import { Ed25519YaoPageLifecycleOwner } from "../../core/signingEngine/threshold/ed25519/yaoPageLifecycleOwner.js";
-import { isWalletCustodySeedBinding } from "../../shared-ts/src/passkey-custody/custodySecretBinding.js";
-import "../../shared-ts/src/passkey-custody/index.js";
-import { establishEvmFamilyCustodyV1, establishNearEd25519CustodyV1, joinEvmFamilyCustodyV1, joinNearEd25519CustodyV1, rejoinEvmFamilyCustodyV1, rejoinNearEd25519CustodyV1 } from "../../core/signingEngine/walletCustody/registrationCeremony.js";
-import { requestWalletCustodyCeremonyOperation, walletCustodyCeremonyStepRunner } from "../../core/signingEngine/walletCustody/ceremonyStepRunner.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { RouterAbEd25519YaoHttpActivationTransportV1 } from "../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { walletCustodyEd25519ActiveClientMetadataV1, walletRecoveryEd25519ActiveClientMetadataV1 } from "../../core/signingEngine/walletCustody/ceremonyActiveClientMetadata.js";
-import { activateWalletRecoveryEd25519V1, admitWalletRecoveryEd25519V1, buildWalletSessionEd25519RecoveryAdmissionRequestV1, executeWalletRecoveryEd25519RoundV1 } from "../../core/signingEngine/walletCustody/walletRecoveryEd25519.js";
-import { parseSigningSessionSealKeyVersion } from "../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { isEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef, walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { clearLinkedDeviceEcdsaHolderMaterialsWasm, destroyLinkedDeviceEcdsaHolderMaterialsWasm, openEcdsaRoleLocalSigningMaterialWasm } from "../../core/signingEngine/threshold/crypto/ecdsaDerivationClientWasm.js";
-import { recoverWalletCustodyManifestV1 } from "../../core/signingEngine/walletCustody/walletRecoveryManifest.js";
-import { deleteWalletCustodyEd25519MaterialV1, loadWalletCustodyEd25519MaterialV1, persistWalletCustodyEd25519MaterialV1 } from "../../core/signingEngine/walletCustody/ed25519SeedMaterial.js";
-import { IndexedDbEcdsaCapabilityManifestStore } from "../../core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js";
-import "../../shared-ts/src/device-linking/index.js";
-import { NEAR_ED25519_YAO_KEY_VERSION_V1 } from "../../shared-ts/src/utils/registrationSignerPlan.js";
-import { WalletSessionAuthorizationUpgradeRequiredError, walletSessionAuthorizations } from "../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { importWalletCustodyEcdsaContinuity } from "../../core/indexedDB/seamsWalletDB/walletCustodyEcdsaContinuity.js";
-import { clearLinkedEcdsaHolderRuntimesV1, listLinkedEcdsaHolderRuntimesV1, removeLinkedEcdsaHolderRuntimeV1, resolveLinkedEcdsaHolderRuntimeV1 } from "../../core/signingEngine/session/material/linkedEcdsaHolderRuntime.js";
-import { SigningAuthPlanKind } from "../../core/signingEngine/stepUpConfirmation/types.js";
-import { fullWalletLoginRequired, invalidWalletSigningMaterial, isWalletSigningStateFailure, walletSigningMaterialBlockError } from "../../core/signingEngine/session/material/walletSigningStateFailure.js";
-import { redactedPasskeyRegistrationCredential, serializeRegistrationCredentialWithPRF } from "../../core/signingEngine/webauthnAuth/credentials/helpers.js";
-import { buildBlockedMpcCapabilityHydrationPlan, buildRehydrateMaterialActivationHydrationPlan, buildUseLiveRuntimeHydrationPlan } from "../../core/signingEngine/session/material/mpcCapabilityHydration.js";
-import { nearEd25519YaoMaterialActivationFromMetadata, nearEd25519YaoRuntimeRef, resolveNearEd25519YaoCapabilityHydrationV1 } from "../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
-import { buildThresholdEd25519WebAuthnPrfSecretSource } from "../../core/signingEngine/threshold/ed25519/walletSession.js";
-import { clearThresholdCommitQueue, resolveThresholdCommitQueueKey } from "../../core/signingEngine/threshold/commitQueueShared.js";
-import { withThresholdEd25519CommitQueue } from "../../core/signingEngine/threshold/ed25519/commitQueue.js";
-import { buildAuthorizationRequiredNearEd25519YaoSigningPreparation, buildAuthorizedNearEd25519YaoSigningPreparation, classifyNearEd25519WalletSessionAuthorization, nearEd25519SessionMatchesMaterialActivation } from "../../core/signingEngine/session/material/nearEd25519YaoSigningPreparation.js";
-import { ed25519DurableMaterialLocator } from "../../core/signingEngine/session/sealedRecovery/materialActivationKey.js";
-import { isConcreteAvailableSigningLane } from "../../core/signingEngine/session/availability/availableSigningLanes.js";
-import { signNear } from "../../core/signingEngine/flows/signNear/signNear.js";
-import { buildRouterAbEd25519SigningWalletSession } from "../../core/signingEngine/session/routerAbSigningWalletSession.js";
-import { listExactSealedSessionsForWallet, readExactEd25519SealedSession } from "../../core/signingEngine/session/persistence/sealedSessionStore.js";
-import { ed25519SealedRuntimeAuthorityRef, parseExactEd25519SealedSessionRuntime, resolveExactEd25519SealedSessionRuntimeForLane, resolveExactEd25519SealedSessionRuntimeForWalletSubject } from "../../core/signingEngine/session/warmCapabilities/ed25519SealedSessionRuntime.js";
-import { buildEmailOtpRouterAbEd25519WalletSessionState, buildPasskeyRouterAbEd25519WalletSessionState, nearEd25519YaoOperationMaterialFacts, rebindRouterAbEd25519WalletSessionStateFromExactRuntime } from "../../core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js";
-import { resolvePasskeyEd25519YaoExportContextV1 } from "../../core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js";
-import { ed25519YaoLocalMaterialIdentityFromWalletSession, hydratePasskeyEd25519YaoLocalMaterialV1, preparePasskeyEd25519YaoLocalMaterialRehydrationV1, readPasskeyEd25519YaoLocalMaterialLocatorV1 } from "../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
-import { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh } from "../../core/signingEngine/session/passkey/ed25519YaoSealedSession.js";
-import { buildRestorableMpcMaterialRefForHydration } from "../../core/signingEngine/session/material/ecdsaCapabilityHydration.js";
-import { readOwnerWalletExecutionLaneProjectionV1 } from "../../core/rpcClients/relayer/ownerWalletExecutionLanePreflight.js";
-import { hydrateWalletExecutionLane } from "../../core/signingEngine/session/lanes/walletExecutionLaneHydration.js";
-import { IndexedDBManager } from "../../core/indexedDB/index.js";
-import { storeNearThresholdKeyMaterial } from "../../core/accountData/near/keyMaterial.js";
-import { persistVerifiedEmailOtpAuthorityAfterUnlock, walletAuthAuthorityRefForVerifiedEmailOtpUnlock } from "../operations/authMethods/emailOtp/walletActivation.js";
-import { isRetryableSealedRefreshCapabilityFetchError } from "../../core/signingEngine/session/warmCapabilities/sealedRefreshParity.js";
-import { buildExactEcdsaPasskeyOwnerLaneScope, buildExactLinkedEmailOtpOwnerLaneScope, buildExactPasskeyOwnerLaneScope, resolveExactOwnerLaneScope, resolveExactWalletAuthAuthority } from "../../core/signingEngine/session/identity/ownerLaneScope.js";
-import { buildFreshEmailOtpRoutePlan } from "../../core/signingEngine/session/emailOtp/routePlan.js";
-import { withThresholdEcdsaSigningQueue } from "../../core/signingEngine/threshold/ecdsa/signingQueue.js";
-import { reconcileTempoNonceLane, reportTempoBroadcastAccepted, reportTempoBroadcastRejected, reportTempoDroppedOrReplaced, reportTempoFinalized, signEvmFamily } from "../../core/signingEngine/flows/signEvmFamily/signEvmFamily.js";
-import { UserConfirmationType } from "../../core/signingEngine/stepUpConfirmation/userConfirmationType.js";
-import { exportKeypairWithUI, resolveExactKeyExportLane } from "../../core/signingEngine/flows/recovery/public.js";
-import { activateAuthenticatedWalletState, finalizeWalletEcdsaRegistration, finalizeWalletEd25519SignerRegistration, getAllUsers, getAuthenticationCredentialsSerialized, getLastUser, getUserBySignerSlot, getWalletNearProvisioningState, hasPasskeyCredential, nearAuthenticatorsByAccount, requestRegistrationCredentialConfirmation, rollbackUserRegistration, rollbackWalletEd25519SignerRegistration, setLastUser, setWalletNearProvisioningState, storeAuthenticator, storeUserData, storeWalletEcdsaRecoverySignerRecords, storeWalletEcdsaSignerRecords, storeWalletEd25519RecoveryRegistrationData, storeWalletEd25519RegistrationData, storeWalletEmailOtpEcdsaRegistrationData, storeWalletEmailOtpEcdsaSignerRecords, storeWalletEmailOtpEd25519RegistrationData, storeWalletEmailOtpMixedRegistrationData, storeWalletMixedRegistrationData } from "../../core/signingEngine/flows/registration/public.js";
-import { exactWalletSessionWithOperationCredentialOrThrow } from "../../core/signingEngine/session/identity/exactWalletSessionReader.js";
-import { enrollEmailOtpInternal, loginWithEmailOtpEcdsaCapabilityInternal, prepareEmailOtpRegistrationEnrollmentMaterialInternal, refreshEmailOtpSigningSession, requestEmailOtpSigningSessionChallenge } from "../../core/signingEngine/flows/signEvmFamily/emailOtpPublic.js";
-import { __isWalletIframeHostMode } from "../../core/browser/walletIframe/host-mode.js";
-import { destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, establishUnlockedWalletEd25519ExportRootCapabilityV1, setUnlockedCustodyEnvelopeUpgradeSinkV1 } from "../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
-import { createManagerAssembly } from "../../core/signingEngine/assembly/createManagers.js";
-import { verifySealedRefreshStartupParity } from "../../core/rpcClients/relayer/sealedRefreshCapabilities.js";
-import { unlockEmailOtpEd25519YaoCapability } from "../../core/signingEngine/session/emailOtp/walletUnlock.js";
-import { WalletCustodyEd25519ActiveClientV1, disposeWalletCustodyEd25519ActiveClientV1 } from "../../core/signingEngine/walletCustody/ed25519ActiveClient.js";
-import { activateWalletCustodyEd25519CapabilityV1 } from "../../core/signingEngine/walletCustody/activateEd25519Capability.js";
-import { resolveWalletCustodyEd25519ProjectionV1 } from "../../core/signingEngine/walletCustody/ed25519Projection.js";
-import { exactEd25519LaneIdentityFromAvailableLane, nearEd25519CapabilityRehydrationKey, nearEd25519CapabilityRehydrationMaterialIdentity, nearEd25519LaneMatchesCapabilityRehydrationSubject } from "../../core/signingEngine/session/warmCapabilities/nearEd25519CapabilityRehydration.js";
-import { generateSessionId } from "../../core/signingEngine/session/passkey/prfCache.js";
-import { resolveEmailOtpEd25519OperationRecoveryBootstrapV1, resolveWalletCustodyEd25519ExportContextV1 } from "../../core/signingEngine/session/emailOtp/ed25519ExportContext.js";
-import { requestClearEmailOtpWarmSessionMaterial, requestRehydrateEmailOtpEd25519YaoOperationMaterial } from "../../core/signingEngine/session/emailOtp/workerRequests.js";
-import { resolveWalletAuthorityOperation } from "../../core/signingEngine/session/authority/authorityOperationResolver.js";
-import { discoverPersistedSessionsForWallet, readOwnerScopedSigningLanes, readPersistedAvailableSigningLanes } from "../../core/signingEngine/session/public.js";
-import { createWarmSigningPorts } from "../../core/signingEngine/assembly/ports/warmSigning.js";
-import { createSessionPublicDeps } from "../../core/signingEngine/assembly/ports/session.js";
-import { clearVolatileWarmSigningMaterial, getWarmThresholdEd25519SessionStatus, hydrateSigningSession, scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill } from "../../core/signingEngine/session/warmCapabilities/public.js";
-import { bootstrapEcdsaSession, connectEd25519Session } from "../../core/signingEngine/session/passkey/public.js";
-import { createBrowserActiveEcdsaWalletSessionAuthorizationResolver, createBrowserCanonicalWalletSessionStatusReader, createBrowserSigningSurfaceEnginePorts, listBrowserActiveEcdsaCapabilityManifestsForWallet, listBrowserEcdsaPreprocessingCapabilitiesForWallet, listBrowserEcdsaSigningCapabilitiesForWallet, readBrowserExactNearEd25519WalletSessionAuthorization, resolveBrowserActiveEcdsaCapabilityRuntime, resolveBrowserActiveEcdsaCapabilityRuntimeForChain, resolveBrowserActiveNearEd25519WalletSessionAuthorization, resolveBrowserNearEd25519PasskeyAuthorityForMaterial } from "../assembly/browserSigningSurfaceAssembly.js";
-import { createBrowserRecoveryPublicDeps } from "../assembly/createBrowserRecoveryPublicDeps.js";
-import { createBrowserStepUpRuntime } from "../assembly/createBrowserStepUpRuntime.js";
-import { createBrowserWarmSessionPublicDeps } from "../assembly/createBrowserWarmSessionPublicDeps.js";
-import { configurePasskeyCustodySessionCachePersistence, readPasskeyCustodySessionEnvelope } from "../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
-import { upgradeWalletCustodyEnvelopeOwnership } from "../../core/rpcClients/relayer/passkeyCustodyEnvelope.js";
-import { finalizeWalletRegistrationEcdsaSessions } from "../../core/signingEngine/flows/registration/services/ecdsaRegistrationSessions.js";
-import { walletIframeRequestIdFromBoundary } from "../../core/types/walletIframeIdentity.js";
-import { walletRecoveryReplacementCredentialFromRegistrationV1 } from "../../core/signingEngine/walletCustody/walletRecoveryCredential.js";
-//#region src/SeamsWeb/signingSurface/BrowserSigningSurface.ts
-async function resolveActiveEd25519WalletSessionAuthorization(walletId, relayerUrl) {
-	return await resolveBrowserActiveNearEd25519WalletSessionAuthorization(walletId, relayerUrl);
-}
-function requireEmailOtpEcdsaRehydrationManifest(manifests, authorityDigest) {
-	let selected = null;
-	for (const manifest of manifests) {
-		if (manifest.signer.authority.authorityDigest !== authorityDigest) continue;
-		if (selected && selected.durableMaterial.roleLocalBinding.keyHandle !== manifest.durableMaterial.roleLocalBinding.keyHandle) throw new Error("[SigningEngine][near] Email OTP ECDSA session identity is ambiguous");
-		selected = manifest;
-	}
-	if (!selected) throw new Error("[SigningEngine][near] Email OTP ECDSA capability is unavailable");
-	return selected;
-}
-function buildEmailOtpEcdsaRehydrationPolicy(args) {
-	const walletSessionMintId = parseWalletSessionMintId(generateSessionId("wallet-session-mint"));
-	if (!walletSessionMintId.ok) throw new Error("[SigningEngine][near] failed to generate an ECDSA Wallet Session mint id");
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: String(args.manifest.durableMaterial.roleLocalBinding.keyHandle),
-		session_policy: {
-			threshold_session_id: SigningSessionIds.thresholdEcdsaSession(generateSessionId("threshold-ecdsa-login")),
-			wallet_session_mint_id: walletSessionMintId.value,
-			ttl_ms: DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-			remaining_uses: args.remainingUses,
-			runtime_policy_scope: args.manifest.durableMaterial.runtimePolicyScope
-		}
-	};
-}
-function activeWalletSessionMatchesCredentialFreeEcdsaActivation(args) {
-	const materialActivation = routerAbMpcMaterialActivationRefFromWire(args.activation.public_capability.material_activation);
-	let matchCount = 0;
-	for (const subject of args.walletSession.capabilitySubjects) if (subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation)) matchCount += 1;
-	return matchCount === 1;
-}
-async function persistRehydratedEmailOtpEcdsaWalletSession(args) {
-	const session = args.response.session;
-	const walletSession = args.authorization.record;
-	const operationCredential = args.authorization.operationCredential;
-	if (String(walletSession.walletId) !== String(args.walletId) || String(args.response.public_capability.client_id) !== String(walletSession.walletId) || walletSession.authorizationId !== session.authorization_id || walletSession.quotaId !== session.quota_id || walletSession.expiresAtMs !== session.expires_at_ms || operationCredential.walletSessionId !== session.wallet_session_id || !activeWalletSessionMatchesCredentialFreeEcdsaActivation({
-		walletSession,
-		activation: args.response
-	})) throw new Error("[SigningEngine][near] refreshed ECDSA exact Wallet Session is inconsistent");
-	await walletSessionAuthorizations.writeExactWithOperationCredential({
-		record: walletSession,
-		operationCredential
-	});
-}
-async function readBrowserEmailOtpProviderSubject(walletId) {
-	return await readEmailOtpProviderSubjectForWalletV1(IndexedDBManager, walletId);
-}
-async function noBrowserWalletPasskeyAuthenticator() {
-	return null;
-}
-const browserSigningSurfaceExactWalletAuthMethodStore = {
-	getWalletAuthMethodV2: (walletAuthMethodId) => IndexedDBManager.getWalletAuthMethodV2(walletAuthMethodId),
-	listWalletAuthMethodsForWallet: (walletId) => IndexedDBManager.listWalletAuthMethodsForWallet(walletId),
-	getWalletPasskeyAuthenticator: noBrowserWalletPasskeyAuthenticator,
-	readEmailOtpProviderSubjectForWallet: readBrowserEmailOtpProviderSubject
-};
-async function resolveBrowserExactPasskeyWalletAuthAuthorityRef(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === WALLET_AUTH_METHODS.passkey && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record || record.kind !== WALLET_AUTH_METHODS.passkey) return null;
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: WALLET_AUTH_METHODS.passkey,
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
-function exactEmailOtpAuthorityRef(args) {
-	const authorityRef = parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: args.walletId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		authorityDigest: args.authorityDigestB64u
-	});
-	if (!authorityRef) throw new Error("[SigningEngine][near] exact Email OTP authority digest is invalid");
-	return authorityRef;
-}
-async function resolveExactEmailOtpFactorAuthority(args) {
-	const factorAuthority = await resolveExactWalletAuthAuthority({
-		authMethod: args.authMethod,
-		stores: browserSigningSurfaceExactWalletAuthMethodStore
-	});
-	if (!isEmailOtpWalletAuthAuthority(factorAuthority) || factorAuthority.walletId !== args.authMethod.walletId || factorAuthority.bindingId !== args.authMethod.walletAuthMethodId || factorAuthority.verifier.emailHashHex !== args.emailHashHex || factorAuthority.factor.providerUserId !== args.providerSubject) throw new Error("[SigningEngine][near] exact Email OTP factor authority changed");
-	return factorAuthority;
-}
-function requireEmailOtpNearEd25519MaterialIdentity(identity) {
-	const auth = identity.auth;
-	switch (auth.kind) {
-		case WALLET_AUTH_METHODS.emailOtp: return {
-			kind: identity.kind,
-			signer: identity.signer,
-			auth,
-			thresholdSessionId: identity.thresholdSessionId
-		};
-		case WALLET_AUTH_METHODS.passkey: throw new Error("[SigningEngine][near] Email OTP material identity is required");
-		default: throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-	}
-}
-/** Selects the exact unlocked Email OTP factor for exhausted-session step-up. */
-async function resolveBrowserNearEd25519EmailOtpAuthorityForMaterial(args) {
-	if (String(args.identity.signer.account.wallet.walletId) !== String(args.walletId) || String(args.identity.signer.account.nearAccountId) !== String(args.nearAccountId) || args.identity.signer.signerSlot !== args.signerSlot) return null;
-	let selected;
-	try {
-		selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId));
-	} catch {
-		return null;
-	}
-	if (selected.kind !== "resolved") return null;
-	const { selection, authMethod, authority } = selected;
-	const ed25519Activation = authority.signerActivations.ed25519;
-	if (selection.lockState !== "unlocked" || selection.walletId !== args.walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.kind !== WALLET_AUTH_METHODS.emailOtp || authMethod.status !== "active" || authMethod.walletId !== args.walletId || authMethod.walletAuthorityId !== authority.authorityId || authority.state !== "active" || authority.walletId !== args.walletId || !ed25519Activation || ed25519Activation.signer.walletId !== args.walletId || !mpcMaterialActivationRefsEqual(ed25519Activation.materialActivation, args.materialActivation)) return null;
-	try {
-		const factorAuthorityRef = await walletAuthAuthorityRef({ authority: await resolveExactEmailOtpFactorAuthority({
-			authMethod,
-			emailHashHex: authMethod.emailHashHex,
-			providerSubject: args.identity.auth.providerSubjectId
-		}) });
-		if (factorAuthorityRef.walletId !== args.walletId || factorAuthorityRef.walletAuthMethodId !== authMethod.walletAuthMethodId) return null;
-		return factorAuthorityRef;
-	} catch {
-		return null;
-	}
-}
-async function resolveExactEmailOtpEd25519ActivationAuthorization(args) {
-	const bootstrapSession = args.bootstrap.session;
-	const stored = args.exactAuthorization?.record ?? await walletSessionAuthorizations.readExact(bootstrapSession.walletSessionId);
-	if (!stored || stored.kind !== "active_wallet_session_v1" || stored.walletId !== args.walletId || stored.authorizationId !== bootstrapSession.authorizationId || stored.quotaId !== bootstrapSession.quotaId || stored.expiresAtMs <= Date.now()) throw new Error("[SigningEngine][near] exact Email OTP activation session is unavailable");
-	const [method, authority] = await Promise.all([IndexedDBManager.getWalletAuthMethodV2(String(stored.authMethodId)), IndexedDBManager.getWalletAuthority(String(stored.authorityId))]);
-	if (!method || method.kind !== "email_otp" || method.status !== "active" || method.walletId !== args.walletId || method.walletAuthorityId !== stored.authorityId || method.emailHashHex !== args.emailHashHex || !authority || authority.state !== "active" || authority.walletId !== args.walletId || authority.authorityId !== stored.authorityId || authority.authorityDigestB64u !== stored.authorityDigestB64u || authority.revocationEpoch !== stored.authorityRevocationEpoch) throw new Error("[SigningEngine][near] exact Email OTP activation authority is unavailable");
-	const authorityRef = exactEmailOtpAuthorityRef({
-		walletId: args.walletId,
-		walletAuthMethodId: method.walletAuthMethodId,
-		authorityDigestB64u: authority.authorityDigestB64u
-	});
-	const factorAuthorityRef = await walletAuthAuthorityRef({ authority: await resolveExactEmailOtpFactorAuthority({
-		authMethod: method,
-		emailHashHex: args.emailHashHex,
-		providerSubject: args.providerSubject
-	}) });
-	if (args.verifiedAuthority && (args.verifiedAuthority.walletId !== factorAuthorityRef.walletId || args.verifiedAuthority.walletAuthMethodId !== factorAuthorityRef.walletAuthMethodId)) throw new Error("[SigningEngine][near] verified Email OTP activation authority changed");
-	const exact = args.exactAuthorization;
-	if (exact) {
-		if (!activeWalletSessionV1RecordsEqual(exact.record, stored) || exact.operationCredential.walletSessionId !== bootstrapSession.walletSessionId) throw new Error("[SigningEngine][near] exact Email OTP activation credential is unavailable");
-		return {
-			authority: authorityRef,
-			operationCredential: exact.operationCredential
-		};
-	}
-	const persisted = await walletSessionAuthorizations.readExactActiveForWallet({
-		walletId: args.walletId,
-		authorityId: stored.authorityId,
-		authMethodId: stored.authMethodId
-	});
-	if (persisted.kind !== "found" || !activeWalletSessionV1RecordsEqual(persisted.record, stored) || persisted.operationCredential.walletSessionId !== bootstrapSession.walletSessionId) throw new Error("[SigningEngine][near] exact Email OTP activation credential is unavailable");
-	return {
-		authority: authorityRef,
-		operationCredential: persisted.operationCredential
-	};
-}
-function unavailableEmailOtpExportAuthorizationFromStatus(status) {
-	switch (status.status) {
-		case "missing": return { kind: "missing" };
-		case "expired": return { kind: "expired" };
-		case "superseded": return { kind: "superseded" };
-		case "authority_unavailable": return { kind: "authority_unavailable" };
-		case "method_unavailable": return { kind: "method_unavailable" };
-		case "capability_unavailable": return { kind: "capability_unavailable" };
-		case "invalid": return { kind: "corrupt" };
-		default: throw new Error("[SigningEngine][ed25519-export] unsupported exact session status");
-	}
-}
-async function readExactEmailOtpEd25519ExportAuthorization(args) {
-	const walletId = args.subject.signer.account.wallet.walletId;
-	let selected;
-	try {
-		selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(walletId));
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	if (selected.kind !== "resolved") return selected.kind === "integrity_error" ? { kind: "corrupt" } : { kind: "missing" };
-	const { selection, authority, authMethod } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authority.state !== "active" || authority.walletId !== walletId || authMethod.kind !== "email_otp" || authMethod.status !== "active" || authMethod.walletId !== walletId || authMethod.walletAuthorityId !== authority.authorityId) return { kind: "corrupt" };
-	let factorAuthority;
-	try {
-		factorAuthority = await resolveExactEmailOtpFactorAuthority({
-			authMethod,
-			emailHashHex: authMethod.emailHashHex,
-			providerSubject: args.subject.auth.providerSubjectId
-		});
-	} catch {
-		return { kind: "corrupt" };
-	}
-	const exact = await walletSessionAuthorizations.readExactActiveForWallet({
-		walletId,
-		authorityId: authority.authorityId,
-		authMethodId: authMethod.walletAuthMethodId
-	});
-	switch (exact.kind) {
-		case "missing":
-		case "upgrade_required":
-		case "corrupt":
-		case "persistence_unavailable": return exact;
-		case "found": break;
-		default: throw new Error("[SigningEngine][ed25519-export] unsupported exact local session result");
-	}
-	if (exact.record.expiresAtMs <= Date.now()) return { kind: "expired" };
-	let status;
-	try {
-		status = await createRelayerExactWalletSessionStatusPort({
-			relayerUrl: args.relayerUrl,
-			operationCredential: exact.operationCredential
-		}).read({
-			walletSessionId: exact.operationCredential.walletSessionId,
-			quotaId: exact.record.quotaId
-		});
-	} catch {
-		return { kind: "persistence_unavailable" };
-	}
-	if (status.status !== "active" && status.status !== "exhausted") return unavailableEmailOtpExportAuthorizationFromStatus(status);
-	return {
-		kind: "found",
-		authorization: {
-			selectedAuthority: authority,
-			selectedAuthMethod: authMethod,
-			factorAuthority,
-			record: exact.record,
-			operationCredential: exact.operationCredential,
-			status
-		}
-	};
-}
-function fetchWithGlobalThis(input, init) {
-	return globalThis.fetch(input, init);
-}
-function currentNearEd25519CapabilityRehydrationSubject(args) {
-	const thresholdSessionId = args.walletSessionState.thresholdSessionId;
-	switch (args.subject.kind) {
-		case "exact_lane": return {
-			kind: "exact_lane",
-			laneIdentity: args.walletSessionState.signingLane.identity
-		};
-		case "export_exact_lane": return {
-			kind: "export_exact_lane",
-			laneIdentity: exactEd25519ExportMaterialIdentity({
-				signer: args.walletSessionState.signingLane.identity.signer,
-				auth: args.walletSessionState.signingLane.identity.auth,
-				thresholdSessionId
-			}),
-			materialActivation: args.subject.materialActivation
-		};
-		case "material_identity": return {
-			kind: "material_identity",
-			materialIdentity: {
-				kind: "near_ed25519_material_identity",
-				signer: args.walletSessionState.signingLane.identity.signer,
-				auth: args.walletSessionState.signingLane.identity.auth,
-				thresholdSessionId
-			}
-		};
-		default: return assertNeverNearEd25519CapabilityRehydrationSubject(args.subject);
-	}
-}
-function assertNeverNearEd25519CapabilityRehydrationSubject(value) {
-	throw new Error(`Unknown Ed25519 capability rehydration subject: ${String(value)}`);
-}
-async function ensurePasskeyEd25519WarmSessionForSigning(args) {
-	const thresholdSessionId = args.walletSessionState.thresholdSessionId;
-	let claim = await args.claimWarmSessionMaterial({
-		thresholdSessionId,
-		purpose: {
-			curve: "ed25519",
-			materialActivation: args.materialActivation
-		},
-		consume: false
-	});
-	if (claim.ok || claim.code !== "not_found") return claim;
-	if (args.runtime.factor.kind !== "passkey") throw new Error("[SigningEngine][near] persisted Ed25519 credential is unavailable");
-	const walletSessionToken = String(args.walletSessionState.walletSessionAuth.walletSessionToken || "").trim();
-	const groupId = String(args.runtime.sealedRecord.groupId || "").trim();
-	if (!walletSessionToken || !groupId) return {
-		ok: false,
-		code: "invalid_args",
-		message: "Passkey Ed25519 sealed restore metadata is incomplete"
-	};
-	if (!mpcMaterialActivationRefsEqual(args.runtime.sealedRecord.ed25519Restore.materialActivation, args.materialActivation)) throw new Error("[SigningEngine][near] persisted Ed25519 material activation mismatch");
-	const keyVersion = parseSigningSessionSealKeyVersion(args.runtime.sealedRecord.keyVersion);
-	const rehydrated = await args.rehydrateWarmSessionMaterial({
-		thresholdSessionId,
-		sealedSecretB64u: args.runtime.sealedRecord.sealedSecretB64u,
-		signingSessionSealKeyVersion: keyVersion,
-		expiresAtMs: args.runtime.sealedRecord.expiresAtMs,
-		remainingUses: args.runtime.sealedRecord.remainingUses,
-		transport: {
-			curve: "ed25519",
-			authMethod: "passkey",
-			walletId: String(args.runtime.walletId),
-			relayerUrl: args.runtime.relayerUrl,
-			signingSessionSealKeyVersion: keyVersion,
-			groupId,
-			walletSessionToken,
-			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-				rpId: args.runtime.factor.rpId,
-				nearAccountId: args.runtime.nearAccountId,
-				nearEd25519SigningKeyId: args.runtime.nearEd25519SigningKeyId,
-				relayerKeyId: args.runtime.relayerKeyId,
-				participantIds: args.runtime.participantIds,
-				runtimePolicyScope: args.runtime.runtimePolicyScope,
-				signerSlot: args.runtime.signerSlot,
-				routerAbNormalSigning: args.runtime.routerAbNormalSigning,
-				credentialIdB64u: args.runtime.factor.credentialIdB64u,
-				materialActivation: args.materialActivation
-			})
-		}
-	});
-	if (!rehydrated.ok) return rehydrated;
-	claim = await args.claimWarmSessionMaterial({
-		thresholdSessionId,
-		purpose: {
-			curve: "ed25519",
-			materialActivation: args.materialActivation
-		},
-		consume: false
-	});
-	return claim;
-}
-async function resolveNearEd25519PublicCapabilityMaterialActivation(args) {
-	const signer = args.identity.signer;
-	const matches = (await args.store.listLanes()).filter((reference) => String(reference.walletId) === String(signer.account.wallet.walletId) && String(reference.nearAccountId) === String(signer.account.nearAccountId) && String(reference.nearEd25519SigningKeyId) === String(signer.nearEd25519SigningKeyId) && reference.signerSlot === signer.signerSlot && String(reference.thresholdSessionId) === String(args.identity.thresholdSessionId) && nearEd25519AuthBindingsEqual(reference.auth, args.identity.auth));
-	if (matches.length > 1) throw new Error("[SigningEngine][near] public Ed25519 capability lane is conflicting");
-	return matches[0]?.materialActivation ?? null;
-}
-function emailOtpEd25519YaoLaneReferenceFromRecovery(args) {
-	const lane = args.walletSessionState.signingLane;
-	const signer = lane.identity.signer;
-	if (lane.auth.kind !== "email_otp") throw new Error("[SigningEngine][near] Email OTP recovery returned another auth lane");
-	return {
-		walletId: signer.account.wallet.walletId,
-		nearAccountId: signer.account.nearAccountId,
-		thresholdSessionId: args.walletSessionState.thresholdSessionId,
-		runtimePolicyScope: args.walletSessionState.runtimePolicyScope,
-		materialActivation: args.materialActivation,
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: lane.auth.providerSubjectId
-		},
-		nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-		signerSlot: signer.signerSlot,
-		remainingUses: args.walletSessionState.signingWalletSession.remainingUses,
-		expiresAtMs: args.walletSessionState.signingWalletSession.expiresAtMs
-	};
-}
-function isLinkedEd25519SignerMaterial(material) {
-	return material.kind === "wallet_authority_linked_signer_material_v1" && material.keyFamily === "ed25519";
-}
-function resolveSelectedEmailOtpEd25519ExportRootV1(args) {
-	const selected = args.selected;
-	if (selected.kind !== "resolved") {
-		const detail = selected.kind === "integrity_error" ? `: ${selected.reason}` : "";
-		throw new Error(`[SigningEngine][ed25519-export] selected Wallet Authority is ${selected.kind}${detail}`);
-	}
-	if (selected.authority.provenance.kind === "wallet_registration" || selected.authority.provenance.kind === "wallet_recovery") return null;
-	const { selection, authMethod, authority, signerMaterials, exportRoot } = selected;
-	const signer = args.subject.signer;
-	const ed25519Activation = authority.signerActivations.ed25519;
-	if (selection.lockState !== "unlocked" || authMethod.kind !== WALLET_AUTH_METHODS.emailOtp || authMethod.status !== "active" || authority.state !== "active" || String(selection.walletId) !== String(signer.account.wallet.walletId) || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletAuthorityId !== authority.authorityId || String(authMethod.walletId) !== String(signer.account.wallet.walletId) || !authority.permissions.includes("export_keys") || !ed25519Activation || !mpcMaterialActivationRefsEqual(ed25519Activation.materialActivation, args.expectedMaterialActivation) || !exportRoot) throw new Error("[SigningEngine][ed25519-export] selected linked Email OTP authority has no exact export root");
-	let linkedMaterial = null;
-	for (const candidate of signerMaterials) {
-		if (!isLinkedEd25519SignerMaterial(candidate) || candidate.authorityId !== authority.authorityId || candidate.walletAuthMethodId !== authMethod.walletAuthMethodId || !mpcMaterialActivationRefsEqual(candidate.materialActivation, args.expectedMaterialActivation)) continue;
-		if (linkedMaterial) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 material is ambiguous");
-		linkedMaterial = candidate;
-	}
-	if (!linkedMaterial) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 material is unavailable");
-	const targetFactor = linkedMaterial.targetFactor;
-	const application = linkedMaterial.publicFacts.applicationBinding;
-	const lifecycle = linkedMaterial.publicFacts.targetBinding.lifecycle;
-	const registeredPublicKeyB64u = ed25519Activation.signer.registeredPublicKeyB64u;
-	if (targetFactor.kind !== WALLET_AUTH_METHODS.emailOtp || targetFactor.walletAuthMethodId !== authMethod.walletAuthMethodId || targetFactor.emailHashHex !== authMethod.emailHashHex || targetFactor.registrationAuthorityId !== authMethod.registrationAuthorityId || exportRoot.authorityId !== authority.authorityId || exportRoot.walletAuthMethodId !== authMethod.walletAuthMethodId || exportRoot.walletKeyId !== ed25519Activation.signer.walletKeyId || exportRoot.envelope.binding.kind !== "ed25519_yao_client_root_v1" || exportRoot.envelope.binding.registeredPublicKeyB64u !== registeredPublicKeyB64u || exportRoot.envelope.factor.kind !== WALLET_AUTH_METHODS.emailOtp || application.wallet_id !== String(signer.account.wallet.walletId) || application.near_ed25519_signing_key_id !== String(signer.nearEd25519SigningKeyId) || application.key_creation_signer_slot !== signer.signerSlot || lifecycle.account_id !== String(signer.account.wallet.walletId) || lifecycle.session_id !== String(args.subject.thresholdSessionId) || lifecycle.selected_server_id !== args.expectedMaterialActivation.signingWorker || base64UrlEncode(Uint8Array.from(linkedMaterial.publicFacts.activationReceipt.registered_public_key)) !== registeredPublicKeyB64u) throw new Error("[SigningEngine][ed25519-export] linked Email OTP export identity changed");
-	if (args.activeCapability) {
-		if (!mpcMaterialActivationRefsEqual(args.activeCapability.materialActivation, args.expectedMaterialActivation) || base64UrlEncode(Uint8Array.from(args.activeCapability.registeredPublicKey)) !== registeredPublicKeyB64u) throw new Error("[SigningEngine][ed25519-export] active Email OTP capability changed");
-		return exportRoot.envelope;
-	}
-	return {
-		envelope: exportRoot.envelope,
-		source: {
-			materialActivation: args.expectedMaterialActivation,
-			signingWorkerId: lifecycle.selected_server_id,
-			participantIds: linkedMaterial.publicFacts.participantIds,
-			registeredPublicKeyB64u
-		}
-	};
-}
-async function resolveLinkedPasskeyOwnerSignerSlot(args) {
-	let material = null;
-	for (const candidate of args.signerMaterials) {
-		if (!isLinkedEd25519SignerMaterial(candidate) || candidate.authorityId !== args.authMethod.walletAuthorityId || candidate.walletAuthMethodId !== args.authMethod.walletAuthMethodId) continue;
-		if (material) throw new Error("[SigningEngine] linked Passkey Ed25519 signer material is conflicting");
-		material = candidate;
-	}
-	if (!material) throw new Error("[SigningEngine] linked Passkey Ed25519 signer material is unavailable");
-	const application = material.publicFacts.applicationBinding;
-	const signerSlot = parseSignerSlot(application.key_creation_signer_slot, { min: 1 });
-	const target = material.targetFactor;
-	if (!signerSlot || application.wallet_id !== String(args.walletId) || String(material.materialActivation.materialOwner) !== String(args.walletId) || target.kind !== WALLET_AUTH_METHODS.passkey || target.walletAuthMethodId !== args.authMethod.walletAuthMethodId || String(target.rpId) !== String(args.authMethod.rpId) || String(target.credentialIdB64u) !== String(args.authMethod.credentialIdB64u)) throw new Error("[SigningEngine] linked Passkey Ed25519 signer material identity is invalid");
-	let laneMatches = 0;
-	for (const reference of await args.publicLaneStore.listLanes()) {
-		if (reference.auth.kind !== "passkey") continue;
-		if (String(reference.walletId) !== String(args.walletId) || String(reference.auth.rpId) !== String(args.authMethod.rpId) || reference.auth.credentialIdB64u !== args.authMethod.credentialIdB64u || String(reference.nearEd25519SigningKeyId) !== String(application.near_ed25519_signing_key_id) || reference.signerSlot !== signerSlot || !mpcMaterialActivationRefsEqual(reference.materialActivation, material.materialActivation)) continue;
-		laneMatches += 1;
-	}
-	if (laneMatches === 0) throw new Error("[SigningEngine] linked Passkey Ed25519 public lane is unavailable");
-	if (laneMatches !== 1) throw new Error("[SigningEngine] linked Passkey Ed25519 public lane is ambiguous");
-	return signerSlot;
-}
-async function resolveExactEmailOtpPublicLaneReference(args) {
-	const signer = args.laneIdentity.signer;
-	const matches = (await args.store.listLanes()).filter((reference) => reference.auth.kind === WALLET_AUTH_METHODS.emailOtp && args.laneIdentity.auth.kind === WALLET_AUTH_METHODS.emailOtp && reference.auth.providerSubjectId === args.laneIdentity.auth.providerSubjectId && String(reference.walletId) === String(signer.account.wallet.walletId) && String(reference.nearAccountId) === String(signer.account.nearAccountId) && String(reference.nearEd25519SigningKeyId) === String(signer.nearEd25519SigningKeyId) && reference.signerSlot === signer.signerSlot && String(reference.thresholdSessionId) === String(args.laneIdentity.thresholdSessionId) && mpcMaterialActivationRefsEqual(reference.materialActivation, args.materialActivation));
-	if (matches.length !== 1) throw new Error(matches.length === 0 ? "[SigningEngine][near] Email OTP public lane is unavailable" : "[SigningEngine][near] Email OTP public lane is ambiguous");
-	return matches[0];
-}
-async function resolveExactPasskeyPublicLaneReference(args) {
-	if (args.laneIdentity.auth.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] Passkey public lane authority is required");
-	const auth = args.laneIdentity.auth;
-	const signer = args.laneIdentity.signer;
-	const matches = (await args.store.listLanes()).filter((reference) => reference.auth.kind === WALLET_AUTH_METHODS.passkey && reference.auth.rpId === auth.rpId && reference.auth.credentialIdB64u === auth.credentialIdB64u && String(reference.walletId) === String(signer.account.wallet.walletId) && String(reference.nearAccountId) === String(signer.account.nearAccountId) && String(reference.nearEd25519SigningKeyId) === String(signer.nearEd25519SigningKeyId) && reference.signerSlot === signer.signerSlot && String(reference.thresholdSessionId) === String(args.laneIdentity.thresholdSessionId));
-	if (matches.length !== 1) throw new Error(matches.length === 0 ? "[SigningEngine][near] Passkey public lane is unavailable" : "[SigningEngine][near] Passkey public lane is ambiguous");
-	return matches[0];
-}
-async function resolveExactNearEd25519PublicLaneReference(args) {
-	const signer = args.identity.signer;
-	const matches = (await args.store.listLanes()).filter((reference) => String(reference.walletId) === String(signer.account.wallet.walletId) && String(reference.nearAccountId) === String(signer.account.nearAccountId) && String(reference.nearEd25519SigningKeyId) === String(signer.nearEd25519SigningKeyId) && reference.signerSlot === signer.signerSlot && String(reference.thresholdSessionId) === String(args.identity.thresholdSessionId) && nearEd25519AuthBindingsEqual(reference.auth, args.identity.auth) && mpcMaterialActivationRefsEqual(reference.materialActivation, args.materialActivation));
-	if (matches.length !== 1) throw new Error(matches.length === 0 ? "[SigningEngine][near] exact Ed25519 public lane is unavailable" : "[SigningEngine][near] exact Ed25519 public lane is ambiguous");
-	return matches[0];
-}
-async function requireExactPasskeyWalletSessionAuthority(args) {
-	if (args.reference.auth.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] Passkey public lane authority is required");
-	if (args.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.passkey || String(args.authorization.session.walletId) !== String(args.reference.walletId)) throw new Error("[SigningEngine][near] Passkey Wallet Session authority does not match lane");
-	const method = await IndexedDBManager.getWalletAuthMethodV2(args.authorization.selectedAuthMethod.walletAuthMethodId);
-	if (!method || method.kind !== WALLET_AUTH_METHODS.passkey || method.status !== "active" || String(method.walletId) !== String(args.reference.walletId) || String(method.rpId) !== String(args.reference.auth.rpId) || String(method.credentialIdB64u) !== String(args.reference.auth.credentialIdB64u)) throw new Error("[SigningEngine][near] Passkey Wallet Session method does not match lane");
-	const authority = await walletAuthAuthorityRef({ authority: {
-		walletId: method.walletId,
-		factor: {
-			kind: WALLET_AUTH_METHODS.passkey,
-			credentialIdB64u: method.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: method.rpId
-		},
-		bindingId: method.walletAuthMethodId
-	} });
-	const selectedFactorRef = await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority });
-	if (authority.authorityDigest !== selectedFactorRef.authorityDigest || authority.walletAuthMethodId !== selectedFactorRef.walletAuthMethodId) throw new Error("[SigningEngine][near] Passkey Wallet Session authority changed");
-	return authority;
-}
-async function passkeyWalletSessionStateFromPublicLane(args) {
-	if (args.reference.auth.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] Passkey public lane authority is required");
-	if (!nearEd25519SessionMatchesMaterialActivation({
-		session: args.authorization.session,
-		materialActivation: args.materialActivation
-	})) throw new Error("[SigningEngine][near] Passkey Wallet Session material changed");
-	const authority = await requireExactPasskeyWalletSessionAuthority({
-		reference: args.reference,
-		authorization: args.authorization
-	});
-	const authorizationId = parseWalletSessionAuthorizationId(args.authorization.session.authorizationId);
-	if (!authorizationId.ok || args.authorization.operationCredential.token.trim().length === 0) throw new Error("[SigningEngine][near] Passkey Ed25519 Wallet Session credential is unavailable");
-	const facts = args.material.facts;
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: String(args.reference.walletId),
-		nearAccountId: String(args.reference.nearAccountId),
-		nearEd25519SigningKeyId: String(args.reference.nearEd25519SigningKeyId),
-		walletSessionId: args.authorization.operationCredential.walletSessionId,
-		authorizationId: authorizationId.value,
-		quotaId: args.authorization.session.quotaId,
-		thresholdSessionId: args.reference.thresholdSessionId,
-		remainingUses: args.authorization.status.remainingUses,
-		expiresAtMs: args.authorization.status.expiresAtMs,
-		runtimePolicyScope: facts.runtimePolicyScope,
-		signingRootId: facts.signingRootId,
-		signingRootVersion: facts.signingRootVersion,
-		routerAbNormalSigning: facts.routerAbNormalSigning,
-		walletSessionToken: args.authorization.operationCredential.token,
-		nowMs: Date.now()
-	});
-	if (!signingWalletSession.ok) throw new Error(`[SigningEngine][near] Passkey Wallet Session is unusable (${signingWalletSession.reason})`);
-	return buildPasskeyRouterAbEd25519WalletSessionState({
-		walletId: args.reference.walletId,
-		nearAccountId: args.reference.nearAccountId,
-		nearEd25519SigningKeyId: args.reference.nearEd25519SigningKeyId,
-		signerSlot: args.reference.signerSlot,
-		rpId: args.reference.auth.rpId,
-		credentialIdB64u: args.reference.auth.credentialIdB64u,
-		relayerUrl: args.relayerUrl,
-		authority,
-		signingWalletSession: signingWalletSession.value
-	});
-}
-async function requireExactEd25519SealedRuntimeForLane(args) {
-	const resolution = await resolveExactEd25519SealedSessionRuntimeForLane(args);
-	if (resolution.kind !== "resolved") throw invalidWalletSigningMaterial(resolution.kind === "conflict" ? "runtime_conflict" : "missing_runtime");
-	return resolution.runtime;
-}
-async function requireExactEd25519SealedRuntimeForMaterialActivation(args) {
-	const record = await readExactEd25519SealedSession(ed25519DurableMaterialLocator({
-		authMethod: args.laneIdentity.auth.kind,
-		materialActivation: args.materialActivation
-	}));
-	if (!record || record.curve !== "ed25519") throw new Error("[SigningEngine][near] exact persisted Ed25519 runtime is missing");
-	const runtime = parseExactEd25519SealedSessionRuntime(record);
-	if (!runtime || String(runtime.walletId) !== String(args.walletId) || String(runtime.nearAccountId) !== String(args.laneIdentity.signer.account.nearAccountId) || String(runtime.nearEd25519SigningKeyId) !== String(args.laneIdentity.signer.nearEd25519SigningKeyId) || runtime.signerSlot !== args.laneIdentity.signer.signerSlot || String(runtime.thresholdSessionId) !== String(args.laneIdentity.thresholdSessionId) || !nearEd25519AuthBindingsEqual(runtime.auth, args.laneIdentity.auth) || !mpcMaterialActivationRefsEqual(runtime.sealedRecord.ed25519Restore.materialActivation, args.materialActivation)) throw new Error("[SigningEngine][near] exact persisted Ed25519 runtime identity mismatch");
-	return runtime;
-}
-async function requireExactEd25519SealedRuntimeForMaterialIdentity(args) {
-	const runtimes = (await listExactSealedSessionsForWallet({
-		walletId: args.walletId,
-		filter: {
-			authMethod: args.identity.auth.kind,
-			curve: "ed25519"
-		}
-	})).filter((record) => record.curve === "ed25519").map(parseExactEd25519SealedSessionRuntime).filter((runtime) => runtime !== null && nearEd25519RuntimeMatchesMaterialIdentity({
-		runtime,
-		identity: args.identity
-	}));
-	if (runtimes.length === 0) throw invalidWalletSigningMaterial("missing_runtime");
-	if (runtimes.length !== 1) throw invalidWalletSigningMaterial("runtime_conflict");
-	return runtimes[0];
-}
-function operationStepUpProofMatchesSelectedWalletAuthMethod(args) {
-	const { selection, authMethod, authority } = args.selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== args.walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== args.walletId || authMethod.walletAuthorityId !== authority.authorityId || authority.walletId !== args.walletId) return false;
-	switch (args.proof.kind) {
-		case "passkey": return authMethod.kind === WALLET_AUTH_METHODS.passkey && args.proof.authority.walletId === args.walletId && args.proof.authority.bindingId === authMethod.walletAuthMethodId && args.proof.authority.factor.credentialIdB64u === authMethod.credentialIdB64u && args.proof.authority.verifier.rpId === authMethod.rpId;
-		case "email_otp": return authMethod.kind === WALLET_AUTH_METHODS.emailOtp && args.proof.authorityRef.walletId === args.walletId && args.proof.authorityRef.walletAuthMethodId === authMethod.walletAuthMethodId;
-		default:
-			args.proof;
-			throw new Error("[SigningEngine][near] unsupported operation step-up proof");
-	}
-}
-async function resolveExactNearEd25519WalletSessionOperationCredentialForStepUp(args) {
-	const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId));
-	if (selected.kind !== "resolved") {
-		const detail = selected.kind === "integrity_error" ? `: ${selected.reason}` : "";
-		throw new Error(`[SigningEngine][near] selected Wallet Authority is ${selected.kind}${detail}`);
-	}
-	if (!operationStepUpProofMatchesSelectedWalletAuthMethod({
-		walletId: args.walletId,
-		proof: args.proof,
-		selected
-	})) throw new Error("[SigningEngine][near] operation step-up authority does not match selection");
-	const operation = await resolveWalletAuthorityOperation({
-		selected: {
-			authMethod: selected.authMethod,
-			authority: selected.authority
-		},
-		operation: {
-			kind: "near_sign",
-			operation: "sign",
-			keyFamily: "ed25519"
-		}
-	});
-	if (operation.kind !== "resolved") throw new Error(`[SigningEngine][near] selected Wallet Authority rejected signing (${operation.reason.kind})`);
-	const exactSession = exactWalletSessionWithOperationCredentialOrThrow(await walletSessionAuthorizations.readExactWithOperationCredential({
-		walletId: args.walletId,
-		authorityId: selected.authority.authorityId,
-		authMethodId: selected.authMethod.walletAuthMethodId
-	}), "[SigningEngine][near] exact Wallet Session requires a newer client");
-	const hasSigningSubject = exactSession?.record.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, operation.value.materialActivation)).length === 1;
-	if (!exactSession || exactSession.record.walletId !== args.walletId || exactSession.record.authorityId !== selected.authority.authorityId || exactSession.record.authMethodId !== selected.authMethod.walletAuthMethodId || exactSession.record.authorityDigestB64u !== selected.authority.authorityDigestB64u || exactSession.record.authorityRevocationEpoch !== selected.authority.revocationEpoch || exactSession.record.expiresAtMs <= Date.now() || !hasSigningSubject) throw new Error("[SigningEngine][near] exact Wallet Session is unavailable for operation step-up");
-	return exactSession.operationCredential;
-}
-async function walletSessionStateFromExactEd25519Runtime(args) {
-	const authorization = await resolveBrowserActiveNearEd25519WalletSessionAuthorization(args.runtime.walletId, args.relayerUrl);
-	if (!authorization) throw new Error("[SigningEngine][near] active Wallet Session authorization is unavailable");
-	return await rebindRouterAbEd25519WalletSessionStateFromExactRuntime({
-		runtime: args.runtime,
-		authorization,
-		nowMs: Date.now()
-	});
-}
-async function preparePasskeyEd25519OperationMaterial(args) {
-	const { identity } = args;
-	if (identity.auth.kind !== WALLET_AUTH_METHODS.passkey) throw invalidWalletSigningMaterial("binding_mismatch");
-	const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId));
-	if (selected.kind !== "resolved" || selected.selection.lockState !== "unlocked" || selected.selection.walletId !== args.walletId || selected.authMethod.kind !== WALLET_AUTH_METHODS.passkey || String(selected.authMethod.rpId) !== String(identity.auth.rpId) || selected.authMethod.credentialIdB64u !== identity.auth.credentialIdB64u) throw invalidWalletSigningMaterial("binding_mismatch");
-	const operation = await resolveWalletAuthorityOperation({
-		selected: {
-			authMethod: selected.authMethod,
-			authority: selected.authority
-		},
-		operation: {
-			kind: "near_sign",
-			operation: "sign",
-			keyFamily: "ed25519"
-		}
-	});
-	if (operation.kind !== "resolved") throw invalidWalletSigningMaterial("missing_capability");
-	const authority = await resolveBrowserExactPasskeyWalletAuthAuthorityRef({
-		walletId: args.walletId,
-		rpId: identity.auth.rpId,
-		credentialIdB64u: identity.auth.credentialIdB64u
-	});
-	if (!authority || authority.walletAuthMethodId !== selected.authMethod.walletAuthMethodId) throw invalidWalletSigningMaterial("binding_mismatch");
-	const local = await readPasskeyEd25519YaoLocalMaterialLocatorV1({
-		store: IndexedDBManager,
-		walletId: String(args.walletId),
-		nearAccountId: String(identity.signer.account.nearAccountId),
-		nearEd25519SigningKeyId: String(identity.signer.nearEd25519SigningKeyId),
-		signerSlot: identity.signer.signerSlot,
-		rpId: identity.auth.rpId,
-		credentialIdB64u: identity.auth.credentialIdB64u,
-		authority
-	});
-	if (local.kind !== "available") throw invalidWalletSigningMaterial("missing_runtime");
-	if (!mpcMaterialActivationRefsEqual(local.locator.materialActivation, operation.value.materialActivation)) throw invalidWalletSigningMaterial("binding_mismatch");
-	const scope = local.locator.stableServerScope;
-	const root = signingRootScopeFromRuntimePolicyScope(scope.runtimePolicyScope);
-	if (!root.signingRootVersion) throw invalidWalletSigningMaterial("binding_mismatch");
-	const localIdentity = {
-		walletId: String(args.walletId),
-		nearAccountId: String(identity.signer.account.nearAccountId),
-		nearEd25519SigningKeyId: String(identity.signer.nearEd25519SigningKeyId),
-		thresholdSessionId: String(identity.thresholdSessionId),
-		signerSlot: identity.signer.signerSlot,
-		rpId: identity.auth.rpId,
-		credentialIdB64u: identity.auth.credentialIdB64u,
-		signingRootId: root.signingRootId,
-		signingRootVersion: root.signingRootVersion,
-		signingWorkerId: scope.routerAbNormalSigning.signingWorkerId
-	};
-	const publicLocator = {
-		kind: "available",
-		walletId: localIdentity.walletId,
-		nearAccountId: localIdentity.nearAccountId,
-		signerSlot: localIdentity.signerSlot,
-		materialActivation: local.locator.materialActivation
-	};
-	const prepared = await prepareExactPasskeyEd25519YaoLocalMaterialRehydration({
-		store: IndexedDBManager,
-		identity: localIdentity,
-		authority,
-		publicLocator
-	});
-	if (prepared.kind === "blocked") throw walletSigningMaterialBlockError(prepared.plan.reason);
-	return {
-		prepared,
-		localIdentity,
-		authority,
-		publicLocator,
-		facts: {
-			thresholdSessionId: identity.thresholdSessionId,
-			signer: identity.signer,
-			signingRootId: root.signingRootId,
-			signingRootVersion: root.signingRootVersion,
-			routerAbNormalSigning: scope.routerAbNormalSigning,
-			runtimePolicyScope: scope.runtimePolicyScope,
-			relayerUrl: args.relayerUrl
-		},
-		participantIds: scope.participantIds
-	};
-}
-function passkeyEd25519LocalMaterialIdentityFromExactRuntime(runtime) {
-	if (runtime.factor.kind !== WALLET_AUTH_METHODS.passkey) throw invalidWalletSigningMaterial("binding_mismatch");
-	return {
-		walletId: String(runtime.walletId),
-		nearAccountId: String(runtime.nearAccountId),
-		nearEd25519SigningKeyId: String(runtime.nearEd25519SigningKeyId),
-		thresholdSessionId: String(runtime.thresholdSessionId),
-		signerSlot: runtime.signerSlot,
-		rpId: String(runtime.factor.rpId),
-		credentialIdB64u: runtime.factor.credentialIdB64u,
-		signingRootId: runtime.signingRootId,
-		signingRootVersion: runtime.signingRootVersion,
-		signingWorkerId: runtime.routerAbNormalSigning.signingWorkerId
-	};
-}
-async function prepareExactPasskeyEd25519YaoLocalMaterialRehydration(input) {
-	try {
-		return await preparePasskeyEd25519YaoLocalMaterialRehydrationV1(input);
-	} catch {
-		throw invalidWalletSigningMaterial("binding_mismatch");
-	}
-}
-async function hydrateExactPasskeyEd25519YaoLocalMaterial(input) {
-	try {
-		return await hydratePasskeyEd25519YaoLocalMaterialV1(input);
-	} catch {
-		throw invalidWalletSigningMaterial("corrupt");
-	}
-}
-function nearEd25519YaoRuntimeObservation(material) {
-	if (!material || material.activeClient.status().kind !== "active") return { kind: "absent" };
-	const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(material.activeClient.metadata());
-	return {
-		kind: "live",
-		runtime: nearEd25519YaoRuntimeRef(materialActivation),
-		materialActivation
-	};
-}
-function nearEd25519MaterialIdentityFromBoundaryInput(input) {
-	if (input.laneIdentity !== void 0) return {
-		kind: "near_ed25519_material_identity",
-		signer: input.laneIdentity.signer,
-		auth: input.laneIdentity.auth,
-		thresholdSessionId: input.laneIdentity.thresholdSessionId
-	};
-	return input.materialIdentity;
-}
-function nearEd25519AuthFromBoundaryInput(input) {
-	return nearEd25519MaterialIdentityFromBoundaryInput(input).auth;
-}
-function nearEd25519PresentedAuthFromBoundaryInput(input) {
-	if (input.auth !== void 0) return input.auth;
-	return input.materialIdentity.auth;
-}
-function nearEd25519SignerFromBoundaryInput(input) {
-	return nearEd25519MaterialIdentityFromBoundaryInput(input).signer;
-}
-function nearEd25519ThresholdSessionIdFromBoundaryInput(input) {
-	return String(nearEd25519MaterialIdentityFromBoundaryInput(input).thresholdSessionId);
-}
-function requireAuthorizedNearEd25519BoundaryInput(input) {
-	if (input.laneIdentity === void 0 || input.auth === void 0) throw new Error("[SigningEngine][near] authorized lane identity is required");
-	return {
-		walletId: input.walletId,
-		nearAccountId: input.nearAccountId,
-		laneIdentity: input.laneIdentity,
-		auth: input.auth
-	};
-}
-function authNeutralNearEd25519BoundaryInput(input) {
-	return {
-		walletId: input.walletId,
-		nearAccountId: input.nearAccountId,
-		materialIdentity: nearEd25519MaterialIdentityFromBoundaryInput(input)
-	};
-}
-async function emailOtpWalletSessionStateFromPublicLane(args) {
-	if (args.reference.auth.kind !== WALLET_AUTH_METHODS.emailOtp) throw new Error("[SigningEngine][near] Email OTP public lane authority is required");
-	if (!nearEd25519SessionMatchesMaterialActivation({
-		session: args.authorization.session,
-		materialActivation: args.materialActivation
-	})) throw new Error("[SigningEngine][near] Email OTP Wallet Session material changed");
-	const authorizationId = parseWalletSessionAuthorizationId(args.authorization.session.authorizationId);
-	if (!authorizationId.ok || args.authorization.operationCredential.token.trim().length === 0) throw new Error("[SigningEngine][near] Email OTP Ed25519 Wallet Session credential is unavailable");
-	const authority = await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority });
-	const facts = args.material.facts;
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: String(args.reference.walletId),
-		nearAccountId: String(args.reference.nearAccountId),
-		nearEd25519SigningKeyId: String(args.reference.nearEd25519SigningKeyId),
-		walletSessionId: args.authorization.operationCredential.walletSessionId,
-		authorizationId: authorizationId.value,
-		quotaId: args.authorization.session.quotaId,
-		thresholdSessionId: args.reference.thresholdSessionId,
-		remainingUses: args.authorization.status.remainingUses,
-		expiresAtMs: args.authorization.status.expiresAtMs,
-		runtimePolicyScope: facts.runtimePolicyScope,
-		signingRootId: facts.signingRootId,
-		signingRootVersion: facts.signingRootVersion,
-		routerAbNormalSigning: facts.routerAbNormalSigning,
-		walletSessionToken: args.authorization.operationCredential.token,
-		nowMs: Date.now()
-	});
-	if (!signingWalletSession.ok) throw new Error(`[SigningEngine][near] Email OTP Wallet Session is unusable (${signingWalletSession.reason})`);
-	return buildEmailOtpRouterAbEd25519WalletSessionState({
-		walletId: args.reference.walletId,
-		nearAccountId: args.reference.nearAccountId,
-		nearEd25519SigningKeyId: args.reference.nearEd25519SigningKeyId,
-		providerSubjectId: args.reference.auth.providerSubjectId,
-		signerSlot: args.reference.signerSlot,
-		relayerUrl: args.relayerUrl,
-		authority,
-		signingWalletSession: signingWalletSession.value
-	});
-}
-function nearEd25519AuthBindingsEqual(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case WALLET_AUTH_METHODS.passkey: return right.kind === WALLET_AUTH_METHODS.passkey && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
-		case WALLET_AUTH_METHODS.emailOtp: return right.kind === WALLET_AUTH_METHODS.emailOtp && left.providerSubjectId === right.providerSubjectId;
-		default: throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-	}
-}
-function nearEd25519RuntimeMatchesMaterialIdentity(args) {
-	const signer = args.identity.signer;
-	return String(args.runtime.walletId) === String(signer.account.wallet.walletId) && String(args.runtime.nearAccountId) === String(signer.account.nearAccountId) && String(args.runtime.nearEd25519SigningKeyId) === String(signer.nearEd25519SigningKeyId) && args.runtime.signerSlot === signer.signerSlot && String(args.runtime.thresholdSessionId) === String(args.identity.thresholdSessionId) && nearEd25519AuthBindingsEqual(args.runtime.auth, args.identity.auth);
-}
-function emailOtpEd25519OperationMaterialFacts(args) {
-	const signingRoot = signingRootScopeFromRuntimePolicyScope(args.publicLane.runtimePolicyScope);
-	if (!signingRoot.signingRootVersion) throw new Error("[SigningEngine][near] Email OTP lane requires a signing-root version");
-	return {
-		thresholdSessionId: args.publicLane.thresholdSessionId,
-		signer: nearEd25519SignerFromBoundaryInput(args.input),
-		signingRootId: signingRoot.signingRootId,
-		signingRootVersion: signingRoot.signingRootVersion,
-		routerAbNormalSigning: {
-			kind: ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND,
-			signingWorkerId: String(args.publicLane.materialActivation.signingWorker)
-		},
-		runtimePolicyScope: args.publicLane.runtimePolicyScope,
-		relayerUrl: args.relayerUrl
-	};
-}
-function assertNearEd25519YaoMaterialBoundaryAuth(input) {
-	const expected = nearEd25519AuthFromBoundaryInput(input);
-	const actual = nearEd25519PresentedAuthFromBoundaryInput(input);
-	if (expected.kind !== actual.kind) throw new Error("[SigningEngine][near] prepared material factor changed");
-	switch (actual.kind) {
-		case WALLET_AUTH_METHODS.passkey:
-			if (expected.kind !== WALLET_AUTH_METHODS.passkey || expected.rpId !== actual.rpId || expected.credentialIdB64u !== actual.credentialIdB64u) throw new Error("[SigningEngine][near] prepared Passkey material binding changed");
-			return;
-		case WALLET_AUTH_METHODS.emailOtp:
-			if (expected.kind !== WALLET_AUTH_METHODS.emailOtp || expected.providerSubjectId !== actual.providerSubjectId) throw new Error("[SigningEngine][near] prepared Email OTP material binding changed");
-			return;
-		default: throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-	}
-}
-function validateExactNearEd25519YaoOperationMaterial(args) {
-	const facts = args.material.facts;
-	const metadata = args.material.activeClient.metadata();
-	const thresholdSessionId = nearEd25519ThresholdSessionIdFromBoundaryInput(args.input);
-	const expectedSigner = nearEd25519SignerFromBoundaryInput(args.input);
-	const actualSigner = facts.signer;
-	if (String(facts.thresholdSessionId) !== thresholdSessionId) throw new Error("[SigningEngine][near] active Ed25519 Yao capability session mismatch");
-	if (metadata.scope.threshold_session_id !== String(facts.thresholdSessionId)) throw new Error("[SigningEngine][near] active Ed25519 Yao metadata session mismatch");
-	if (metadata.scope.account_id !== String(args.input.walletId) || metadata.applicationBinding.wallet_id !== String(args.input.walletId)) throw new Error("[SigningEngine][near] active Ed25519 Yao capability subject mismatch");
-	if (String(actualSigner.account.wallet.walletId) !== String(expectedSigner.account.wallet.walletId) || String(actualSigner.account.nearAccountId) !== String(expectedSigner.account.nearAccountId) || actualSigner.signerSlot !== expectedSigner.signerSlot || String(actualSigner.nearEd25519SigningKeyId) !== String(expectedSigner.nearEd25519SigningKeyId)) throw new Error("[SigningEngine][near] active Ed25519 Yao capability signer mismatch");
-	const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(metadata);
-	if (!mpcMaterialActivationRefsEqual(args.expectedActivation, materialActivation)) throw new Error("[SigningEngine][near] active Ed25519 Yao capability activation mismatch");
-	return args.material;
-}
-async function hydrateOwnerNearEd25519ExecutionLane(args) {
-	const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(args.material.activeClient.metadata());
-	if (!nearEd25519SessionMatchesMaterialActivation({
-		session: args.authorization.session,
-		materialActivation
-	})) throw new Error("Owner Ed25519 execution-lane material changed");
-	const walletSessionToken = args.authorization.operationCredential.token;
-	const exactMaterial = validateExactNearEd25519YaoOperationMaterial({
-		material: args.material,
-		input: args.input,
-		expectedActivation: materialActivation
-	});
-	const authority = await ed25519SealedRuntimeAuthorityRef({
-		runtime: args.sealedRuntime,
-		walletAuthMethodId: args.authorization.selectedAuthMethod.walletAuthMethodId
-	});
-	const selectedFactorAuthority = await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority });
-	if (authority.walletId !== selectedFactorAuthority.walletId || authority.walletAuthMethodId !== selectedFactorAuthority.walletAuthMethodId || authority.authorityDigest !== selectedFactorAuthority.authorityDigest) throw new Error("Owner Ed25519 execution-lane authority does not match sealed material");
-	const runtime = nearEd25519YaoRuntimeObservation(exactMaterial);
-	if (runtime.kind !== "live") throw new Error("Owner Ed25519 execution-lane preflight requires active Yao material");
-	const hydration = {
-		publicLocator: {
-			kind: "available",
-			walletId: String(exactMaterial.facts.signer.account.wallet.walletId),
-			nearAccountId: String(exactMaterial.facts.signer.account.nearAccountId),
-			signerSlot: exactMaterial.facts.signer.signerSlot,
-			materialActivation,
-			authority
-		},
-		sealed: { kind: "missing" },
-		runtime,
-		unlockSource: { kind: "unavailable" }
-	};
-	return assertOwnerNearEd25519ExecutionLaneProjection({
-		projection: await readOwnerWalletExecutionLaneProjectionV1({
-			relayerUrl: exactMaterial.facts.relayerUrl,
-			walletSessionToken,
-			curve: "ed25519",
-			expectedMaterialActivation: materialActivation
-		}),
-		material: exactMaterial,
-		hydration
-	});
-}
-function assertOwnerNearEd25519ExecutionLaneProjection(args) {
-	const hydrated = hydrateWalletExecutionLane({
-		walletKey: args.projection.walletKey,
-		lane: args.projection.lane,
-		material: {
-			keyFamily: "ed25519",
-			laneShareEpoch: args.projection.lane.laneShareEpoch,
-			metadata: args.material.activeClient.metadata(),
-			hydration: args.hydration
-		}
-	});
-	if (hydrated.kind !== "active_wallet_execution_lane_v1") throw new Error(`Owner Ed25519 execution lane is ${hydrated.reason}`);
-	if (!mpcMaterialActivationRefsEqual(hydrated.materialActivation, args.projection.materialActivation) || hydrated.activationReceiptDigestB64u !== String(args.projection.verifiedActivationReceiptDigestB64u)) throw new Error("Owner Ed25519 execution-lane projection activation changed");
-	return hydrated;
-}
-function requireNearEd25519YaoPreparationActivation(preparation) {
-	const materialActivation = preparation.hydration.materialActivation;
-	if (!materialActivation) throw new Error("[SigningEngine][near] prepared material has no activation");
-	return materialActivation;
-}
-function requireBoundNearEd25519YaoPreparationActivation(args) {
-	const materialActivation = requireNearEd25519YaoPreparationActivation(args.preparation);
-	if (!args.context.materialActivation || !mpcMaterialActivationRefsEqual(args.context.materialActivation, materialActivation)) throw new Error("[SigningEngine][near] prepared material boundary changed activation");
-	return materialActivation;
-}
-function serializePreparedRegistrationCredential(credential) {
-	return serializeRegistrationCredentialWithPRF({
-		credential,
-		firstPrfOutput: true,
-		secondPrfOutput: true
-	});
-}
-async function loadEcdsaRoleLocalReadyRecordFromRuntimePorts(runtimePortsRef, input) {
-	if (!runtimePortsRef.current) return {
-		ok: false,
-		code: "unavailable",
-		message: "Signing runtime storage is not initialized"
-	};
-	return await runtimePortsRef.current.storage.loadEcdsaRoleLocalReadyRecord(input);
-}
-function sdkLifecycleEventDeliveryKey(event) {
-	const eventName = event.event;
-	switch (eventName) {
-		case "signing_session.expired": return `${String(event.walletId)}:${String(event.walletSessionId)}`;
-		case "registration.near_provisioning_changed": return `${String(event.walletId)}:${event.state.status}:${event.state.updatedAtMs}`;
-		default: return assertNeverSdkLifecycleEventName(eventName);
-	}
-}
-function assertNeverSdkLifecycleEventName(value) {
-	throw new Error(`Unsupported SDK lifecycle event: ${String(value)}`);
-}
-async function readBrowserPasskeyCustodySessionCache(key) {
-	if (IndexedDBManager.isDisabled()) return void 0;
-	return await IndexedDBManager.getAppState(key);
-}
-async function writeBrowserPasskeyCustodySessionCache(key, value) {
-	if (IndexedDBManager.isDisabled()) return;
-	await IndexedDBManager.setAppState(key, value);
-}
-const browserPasskeyCustodySessionCachePersistence = {
-	readCacheEntry: readBrowserPasskeyCustodySessionCache,
-	writeCacheEntry: writeBrowserPasskeyCustodySessionCache
-};
-var BrowserSigningSurface = class {
-	readExactNearEd25519WalletSessionAuthorization(walletId) {
-		return readBrowserExactNearEd25519WalletSessionAuthorization(String(this.seamsWebConfigs.network.relayer?.url || "").trim(), new WalletSessionStatusReadScope(), walletId);
-	}
-	resolveActiveNearEd25519WalletSessionAuthorization(walletId) {
-		return resolveBrowserActiveNearEd25519WalletSessionAuthorization(walletId, String(this.seamsWebConfigs.network.relayer?.url || "").trim());
-	}
-	constructor(seamsWebConfigs, nearClient, deps) {
-		this.workerBaseOrigin = "";
-		this.thresholdEcdsaBootstrapQueueByWallet = /* @__PURE__ */ new Map();
-		this.thresholdEcdsaSigningQueueByKey = /* @__PURE__ */ new Map();
-		this.thresholdEd25519CommitQueueByKey = /* @__PURE__ */ new Map();
-		this.nearEd25519CapabilityRehydrationBySubject = /* @__PURE__ */ new Map();
-		this.hostWarmCriticalResourcesTask = null;
-		this.sealedRefreshStartupParityError = null;
-		this.sdkLifecycleEventListeners = /* @__PURE__ */ new Set();
-		this.deliveredSdkLifecycleEventKeys = /* @__PURE__ */ new Set();
-		this.walletAuthenticationState = { kind: "signed_out" };
-		this.walletAuthenticationRestoreGeneration = 0;
-		this.volatileWarmSigningMaterialCleanupInFlight = null;
-		this.requestWorkerOperation = (args) => this.signerWorkerManager.getContext().requestWorkerOperation(args);
-		configurePasskeyCustodySessionCachePersistence(browserPasskeyCustodySessionCachePersistence);
-		this.seamsWebConfigs = seamsWebConfigs;
-		this.ed25519YaoPublicCapabilityReferences = deps.ed25519YaoPublicCapabilityReferences;
-		this.appearance = seamsWebConfigs.ui.appearance;
-		this.nearClient = nearClient;
-		this.ecdsaBootstrapStore = deps.signingEngineStores.walletProfileAndSignerRecords.ecdsaBootstrapStore;
-		this.sealedRefreshStartupParityPromise = verifySealedRefreshStartupParity({ configs: this.seamsWebConfigs }).catch((error) => {
-			this.sealedRefreshStartupParityError = error instanceof Error ? error : new Error(String(error || "sealed refresh parity check failed"));
-		});
-		const runtimePortsForUiConfirm = { current: null };
-		const loadEcdsaRoleLocalReadyRecord = loadEcdsaRoleLocalReadyRecordFromRuntimePorts.bind(null, runtimePortsForUiConfirm);
-		const assembly = createManagerAssembly({
-			resolveActiveEcdsaCapabilityRuntime: resolveBrowserActiveEcdsaCapabilityRuntime,
-			resolveOperationStepUpCredential: this.resolveOperationStepUpCredential.bind(this),
-			stores: deps.managerStores,
-			seamsWebConfigs: this.seamsWebConfigs,
-			nearClient: this.nearClient,
-			loadEcdsaRoleLocalReadyRecord,
-			getTheme: () => this.appearance.theme.mode,
-			getAppearance: () => this.appearance,
-			thresholdEcdsaSigningQueueByKey: this.thresholdEcdsaSigningQueueByKey
-		});
-		this.touchIdPrompt = assembly.touchIdPrompt;
-		this.userPreferencesManager = assembly.userPreferencesManager;
-		this.nonceCoordinator = assembly.nonceCoordinator;
-		this.signerWorkerManager = assembly.signerWorkerManager;
-		const signingRuntime = deps.createRuntime({
-			config: this.seamsWebConfigs,
-			workerCtx: this.signerWorkerManager.getContext(),
-			accountLifecycle: {
-				accountStore: deps.signingEngineStores.walletProfileAndSignerRecords.accountStore,
-				userPreferencesManager: this.userPreferencesManager,
-				nonceCoordinator: this.nonceCoordinator
-			},
-			ecdsaBootstrapStore: this.ecdsaBootstrapStore,
-			getWarmSessionMaterialWriter: () => this.passkeyMpcSession,
-			getNearSigningDeps: () => this.enginePorts.nearSigningDeps,
-			getEvmFamilySigningDeps: () => this.enginePorts.tempoSigningDeps
-		});
-		runtimePortsForUiConfirm.current = signingRuntime.runtimePorts;
-		const ecdsaExportArtifactStore = signingRuntime.state.ecdsaSessions;
-		this.runtimePorts = signingRuntime.runtimePorts;
-		const stepUpRuntime = createBrowserStepUpRuntime({
-			seamsWebConfigs: this.seamsWebConfigs,
-			touchIdPrompt: this.touchIdPrompt,
-			signerWorkerManager: this.signerWorkerManager,
-			stores: deps.signingEngineStores,
-			runtimePorts: this.runtimePorts,
-			sealedSigningSessionStore: deps.sealedSigningSessionStore,
-			baseTouchConfirm: assembly.touchConfirm,
-			passkeyMpcSession: assembly.passkeyMpcSession,
-			getEnginePorts: () => this.enginePorts,
-			thresholdEcdsaBootstrapQueueByWallet: this.thresholdEcdsaBootstrapQueueByWallet,
-			thresholdEcdsaSigningQueueByKey: this.thresholdEcdsaSigningQueueByKey,
-			loadWalletCustodyEd25519Material: this.loadEmailOtpWalletCustodyEd25519Material.bind(this),
-			restoreWalletCustodyEcdsaContinuity: this.restoreWalletCustodyEcdsaContinuity.bind(this),
-			getWarmSigning: () => this.warmSigning,
-			ensureSealedRefreshStartupParity: () => this.ensureSealedRefreshStartupParity(),
-			listActiveEcdsaCapabilityManifestsForWallet: listBrowserActiveEcdsaCapabilityManifestsForWallet
-		});
-		this.emailOtpSessions = stepUpRuntime.emailOtpSessions;
-		this.touchConfirm = stepUpRuntime.touchConfirm;
-		this.passkeyMpcSession = stepUpRuntime.passkeyMpcSession;
-		this.warmSigning = createWarmSigningPorts({
-			resolveActiveEcdsaCapabilityRuntime: resolveBrowserActiveEcdsaCapabilityRuntime,
-			resolveActiveEcdsaCapabilityRuntimeForChain: resolveBrowserActiveEcdsaCapabilityRuntimeForChain,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			getEmailOtpWarmSessionStatus: (target) => this.emailOtpSessions.readWarmSessionStatusOnly(target),
-			signingSessionSeal: this.seamsWebConfigs.signing.sessionSeal,
-			ecdsaExportArtifacts: ecdsaExportArtifactStore,
-			resolveActiveEcdsaWalletSessionAuthorization: createBrowserActiveEcdsaWalletSessionAuthorizationResolver({
-				seamsWebConfigs: this.seamsWebConfigs,
-				touchIdPrompt: this.touchIdPrompt,
-				stores: deps.signingEngineStores,
-				emailOtpSessions: this.emailOtpSessions,
-				sealedSigningSessionStore: deps.sealedSigningSessionStore
-			}),
-			resolveActiveEd25519WalletSessionAuthorization: this.resolveActiveNearEd25519WalletSessionAuthorization.bind(this)
-		});
-		this.listPreprocessingCapabilities = listBrowserEcdsaPreprocessingCapabilitiesForWallet.bind(null, {
-			seamsWebConfigs: this.seamsWebConfigs,
-			touchIdPrompt: this.touchIdPrompt,
-			stores: deps.signingEngineStores,
-			emailOtpSessions: this.emailOtpSessions,
-			sealedSigningSessionStore: deps.sealedSigningSessionStore
-		});
-		this.sessionPublicDeps = createSessionPublicDeps({
-			seamsWebConfigs: this.seamsWebConfigs,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			emailOtpSessions: this.emailOtpSessions,
-			ed25519YaoPublicCapabilityLanes: deps.ed25519YaoPublicCapabilityReferences,
-			isEd25519YaoPublicCapabilityActive: this.isEd25519YaoPublicCapabilityActive.bind(this),
-			readActiveWalletSessionAuthorization: readBrowserExactNearEd25519WalletSessionAuthorization.bind(null, this.seamsWebConfigs.network.relayer.url),
-			listEcdsaSigningCapabilitiesForWallet: (input, statusReads) => listBrowserEcdsaSigningCapabilitiesForWallet({
-				seamsWebConfigs: this.seamsWebConfigs,
-				touchIdPrompt: this.touchIdPrompt,
-				stores: deps.signingEngineStores,
-				emailOtpSessions: this.emailOtpSessions,
-				sealedSigningSessionStore: deps.sealedSigningSessionStore
-			}, input, statusReads),
-			getWalletSessionStatus: createBrowserCanonicalWalletSessionStatusReader({
-				seamsWebConfigs: this.seamsWebConfigs,
-				touchIdPrompt: this.touchIdPrompt,
-				stores: deps.signingEngineStores,
-				emailOtpSessions: this.emailOtpSessions,
-				sealedSigningSessionStore: deps.sealedSigningSessionStore
-			})
-		});
-		this.emailOtpPublicDeps = {
-			relayerUrl: this.seamsWebConfigs.network.relayer?.url || "",
-			groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-			signingSessionAuthorityPorts: {
-				resolveActiveEcdsaCapabilityRuntime: resolveBrowserActiveEcdsaCapabilityRuntime,
-				factorStores: browserSigningSurfaceExactWalletAuthMethodStore,
-				resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
-				readExactWalletSessionAuthorization: walletSessionAuthorizations.readExactWithOperationCredential.bind(walletSessionAuthorizations)
-			},
-			getSignerWorkerContext: () => this.enginePorts.walletSessionActivationDeps.getSignerWorkerContext(),
-			withThresholdEcdsaSigningQueue: (queueArgs) => withThresholdEcdsaSigningQueue({
-				queueByKey: this.thresholdEcdsaSigningQueueByKey,
-				...queueArgs
-			}),
-			emailOtpSessions: this.emailOtpSessions
-		};
-		this.recoveryPublicDeps = createBrowserRecoveryPublicDeps({
-			seamsWebConfigs: this.seamsWebConfigs,
-			runtimePorts: this.runtimePorts,
-			signerWorkerManager: this.signerWorkerManager,
-			warmSigning: this.warmSigning,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			passkeyMpcExport: assembly.passkeyMpcExport,
-			emailOtpSessions: this.emailOtpSessions,
-			thresholdEcdsaBootstrapQueueByWallet: this.thresholdEcdsaBootstrapQueueByWallet,
-			thresholdEcdsaSigningQueueByKey: this.thresholdEcdsaSigningQueueByKey,
-			thresholdEd25519CommitQueueByKey: this.thresholdEd25519CommitQueueByKey,
-			getWalletSessionActivationDeps: () => this.enginePorts.walletSessionActivationDeps,
-			resolvePasskeyEd25519YaoExportContext: this.resolveExactPasskeyEd25519YaoExportContext.bind(this),
-			resolveEmailOtpEd25519YaoExportContext: this.resolveEmailOtpEd25519YaoExportContext.bind(this),
-			getSigningSessionCoordinator: () => this.enginePorts.signingSessionCoordinator,
-			getTheme: () => this.appearance.theme.mode,
-			ed25519YaoPublicCapabilityLanes: deps.ed25519YaoPublicCapabilityReferences,
-			isEd25519YaoPublicCapabilityActive: this.isEd25519YaoPublicCapabilityActive.bind(this),
-			readActiveWalletSessionAuthorization: readBrowserExactNearEd25519WalletSessionAuthorization.bind(null, this.seamsWebConfigs.network.relayer.url),
-			listEcdsaSigningCapabilitiesForWallet: (input, statusReads) => listBrowserEcdsaSigningCapabilitiesForWallet({
-				seamsWebConfigs: this.seamsWebConfigs,
-				touchIdPrompt: this.touchIdPrompt,
-				stores: deps.signingEngineStores,
-				emailOtpSessions: this.emailOtpSessions,
-				sealedSigningSessionStore: deps.sealedSigningSessionStore
-			}, input, statusReads),
-			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId)
-		});
-		this.enginePorts = createBrowserSigningSurfaceEnginePorts({
-			runtimePorts: this.runtimePorts,
-			stores: deps.signingEngineStores,
-			ed25519YaoPublicCapabilityReferences: deps.ed25519YaoPublicCapabilityReferences,
-			seamsWebConfigs: this.seamsWebConfigs,
-			nearClient: this.nearClient,
-			touchIdPrompt: this.touchIdPrompt,
-			userPreferencesManager: this.userPreferencesManager,
-			nonceCoordinator: this.nonceCoordinator,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			passkeyMpcExport: assembly.passkeyMpcExport,
-			signerWorkerManager: this.signerWorkerManager,
-			emailOtpSessions: this.emailOtpSessions,
-			warmSigning: this.warmSigning,
-			sealedSigningSessionStore: deps.sealedSigningSessionStore,
-			ecdsaBootstrapStore: this.ecdsaBootstrapStore,
-			thresholdEcdsaBootstrapQueueByWallet: this.thresholdEcdsaBootstrapQueueByWallet,
-			thresholdEcdsaSigningQueueByKey: this.thresholdEcdsaSigningQueueByKey,
-			thresholdEd25519CommitQueueByKey: this.thresholdEd25519CommitQueueByKey,
-			getWorkerBaseOrigin: () => this.workerBaseOrigin,
-			workerWarmupPolicy: deps.workerWarmupPolicy,
-			getTheme: () => this.appearance.theme.mode,
-			ensureSealedRefreshStartupParity: () => this.ensureSealedRefreshStartupParity(),
-			resolveOwnerLaneScope: (walletId) => this.resolveSelectedOwnerLaneScope(walletId),
-			getEnginePorts: () => this.enginePorts,
-			getRegistrationPublicDeps: () => this.registrationPublicDeps,
-			prepareNearEd25519YaoMaterialBoundary: this.prepareExactNearEd25519YaoMaterialBoundary.bind(this)
-		});
-		this.signingSessionLifecycleSubscription = this.enginePorts.signingSessionCoordinator.subscribeLifecycle(this.publishSdkLifecycleEvent.bind(this));
-		this.nearProvisioningUnsubscribe = subscribeToNearProvisioning(this.publishNearProvisioningLifecycleEvent.bind(this));
-		this.ed25519YaoPageLifecycleOwner = new Ed25519YaoPageLifecycleOwner(typeof window === "undefined" ? null : window, this.enginePorts.ed25519YaoActiveClients);
-		const warmSessionPublicDeps = createBrowserWarmSessionPublicDeps({
-			seamsWebConfigs: this.seamsWebConfigs,
-			stores: deps.signingEngineStores,
-			touchIdPrompt: this.touchIdPrompt,
-			touchConfirm: this.touchConfirm,
-			passkeyMpcSession: this.passkeyMpcSession,
-			warmSigning: this.warmSigning,
-			runtimePorts: this.runtimePorts,
-			thresholdEcdsaBootstrapQueueByWallet: this.thresholdEcdsaBootstrapQueueByWallet,
-			ensureSealedRefreshStartupParity: () => this.ensureSealedRefreshStartupParity(),
-			enginePorts: this.enginePorts
-		});
-		this.passkeyPublicDeps = warmSessionPublicDeps.passkeyPublicDeps;
-		this.warmCapabilitiesPublicDeps = warmSessionPublicDeps.warmCapabilitiesPublicDeps;
-		this.registrationPublicDeps = {
-			accountLifecycle: this.enginePorts.registrationAccountLifecycleDeps,
-			session: this.enginePorts.registrationSessionDeps
-		};
-		setUnlockedCustodyEnvelopeUpgradeSinkV1((upgrade) => {
-			this.persistUpgradedWalletCustodyEnvelopeV1(upgrade);
-		});
-		deps.initializeRuntime({
-			config: this.seamsWebConfigs,
-			userPreferencesManager: this.userPreferencesManager,
-			getWorkerBaseOrigin: () => this.workerBaseOrigin,
-			setWorkerBaseOrigin: (origin) => {
-				this.workerBaseOrigin = origin;
-				this.signerWorkerManager.setWorkerBaseOrigin(origin);
-				this.touchConfirm.setWorkerBaseOrigin?.(origin);
-				assembly.passkeyMpcExport.setWorkerBaseOrigin(origin);
-				this.passkeyMpcSession.setWorkerBaseOrigin(origin);
-			}
-		});
-	}
-	async resolveOperationStepUpCredential(args) {
-		return {
-			kind: "wallet_session_opaque",
-			walletSessionToken: (await resolveExactNearEd25519WalletSessionOperationCredentialForStepUp({
-				walletId: args.walletId,
-				proof: args.proof
-			})).token
-		};
-	}
-	async ensureSealedRefreshStartupParity() {
-		await this.sealedRefreshStartupParityPromise;
-		if (this.sealedRefreshStartupParityError) throw this.sealedRefreshStartupParityError;
-	}
-	/**
-	* Runs one wallet custody key set for NEAR, from the registration flow.
-	*
-	* The flow never touches the ceremony worker itself: a run's seed lives in
-	* that worker's wasm state across three steps, so this is the one place the
-	* channel is reached and the one place the Router round is wired to it.
-	*
-	* The Router round is performed through the same HTTP transport the
-	* PRF-derived path used, so the execute request goes to the same endpoint
-	* with the same trace context — only the root behind it changed.
-	*/
-	async establishWalletCustodyNearEd25519KeySet(args) {
-		const transport = new RouterAbEd25519YaoHttpActivationTransportV1({
-			routerOrigin: args.routerOrigin,
-			authorization: {
-				kind: "bearer",
-				value: args.authorization
-			},
-			fetch: globalThis.fetch,
-			...args.traceContext ? { traceContext: args.traceContext } : {}
-		});
-		let activationResultJson = null;
-		const established = await establishNearEd25519CustodyV1({
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1()),
-			walletId: args.walletId,
-			factorJson: args.factorJson,
-			factorSecret: args.factorSecret,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			registrationCeremonyId: args.registrationCeremonyId,
-			yaoAdmission: args.admissionReceipt,
-			yaoApplication: args.admissionRequest.application_binding,
-			participantIds: args.participantIds,
-			runRouterRound: async (yaoExecuteRequestJson) => {
-				const response = await transport.send({
-					kind: "execute",
-					path: ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1,
-					body: JSON.parse(yaoExecuteRequestJson)
-				});
-				if (!response.ok) throw new Error(`Router Ed25519 Yao execute failed: ${response.message}`);
-				activationResultJson = JSON.stringify(response.value);
-				return activationResultJson;
-			}
-		});
-		if (!activationResultJson) throw new Error("the wallet custody NEAR run completed without a Router activation result");
-		if (!established.localMaterial) throw new Error("the wallet custody NEAR run sealed no local material");
-		return {
-			recoveryCodes: established.recoveryCodes,
-			commitPayload: established.commitPayload,
-			activationReference: established.activationReference,
-			localMaterial: established.localMaterial,
-			metadata: walletCustodyEd25519ActiveClientMetadataV1({
-				admissionRequest: args.admissionRequest,
-				activationResultJson
-			})
-		};
-	}
-	async recoverWalletCustodyManifest(args) {
-		return await recoverWalletCustodyManifestV1({
-			...args,
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1()),
-			workerCtx: this.signerWorkerManager.getContext()
-		});
-	}
-	async createWalletRecoveryReplacementCredential(args) {
-		const requestId = walletIframeRequestIdFromBoundary(`wallet-recovery:${args.registration.challengeId}`);
-		const replacement = walletRecoveryReplacementCredentialFromRegistrationV1(serializePreparedRegistrationCredential(await this.touchIdPrompt.generateRegistrationCredentialsInternal({
-			kind: "wallet_recovery",
-			walletId: args.walletId,
-			intendedUserName: args.walletId,
-			recoveryRegistration: args.registration,
-			prompt: {
-				kind: "immediate",
-				requestId,
-				cancellation: args.cancellation
-			}
-		})));
-		return {
-			registration: redactedPasskeyRegistrationCredential(replacement.registration),
-			credentialIdB64u: replacement.credentialIdB64u,
-			factorSecret: replacement.factorSecret
-		};
-	}
-	async joinWalletCustodyNearEd25519KeySet(args) {
-		const transport = new RouterAbEd25519YaoHttpActivationTransportV1({
-			routerOrigin: args.routerOrigin,
-			authorization: {
-				kind: "bearer",
-				value: args.authorization
-			},
-			fetch: globalThis.fetch,
-			...args.traceContext ? { traceContext: args.traceContext } : {}
-		});
-		let activationResultJson = null;
-		const joined = await joinNearEd25519CustodyV1({
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1()),
-			preparation: args.preparation,
-			beforeRouterRound: args.beforeRouterRound,
-			custodyJson: args.custodyJson,
-			factorSecret: args.factorSecret,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			registrationCeremonyId: args.registrationCeremonyId,
-			yaoAdmission: args.admissionReceipt,
-			yaoApplication: args.admissionRequest.application_binding,
-			participantIds: args.participantIds,
-			runRouterRound: async (yaoExecuteRequestJson) => {
-				const response = await transport.send({
-					kind: "execute",
-					path: ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1,
-					body: JSON.parse(yaoExecuteRequestJson)
-				});
-				if (!response.ok) throw new Error(`Router Ed25519 Yao execute failed: ${response.message}`);
-				activationResultJson = JSON.stringify(response.value);
-				return activationResultJson;
-			}
-		});
-		if (!activationResultJson || !joined.localMaterial) throw new Error("the wallet custody NEAR join produced no local signing material");
-		return {
-			commitPayload: joined.commitPayload,
-			activationReference: joined.activationReference,
-			localMaterial: joined.localMaterial,
-			metadata: walletCustodyEd25519ActiveClientMetadataV1({
-				admissionRequest: args.admissionRequest,
-				activationResultJson
-			})
-		};
-	}
-	async rejoinWalletCustodyNearEd25519KeySet(args) {
-		const transport = new RouterAbEd25519YaoHttpActivationTransportV1({
-			routerOrigin: args.routerOrigin,
-			authorization: {
-				kind: "bearer",
-				value: `Bearer ${args.walletSessionToken}`
-			},
-			fetch: globalThis.fetch
-		});
-		const recoveryRequest = await buildWalletSessionEd25519RecoveryAdmissionRequestV1({ basis: args.recoveryBasis });
-		const admitted = await admitWalletRecoveryEd25519V1({
-			request: recoveryRequest,
-			transport
-		});
-		const rejoined = await rejoinNearEd25519CustodyV1({
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1()),
-			walletId: args.walletId,
-			custodyJson: args.custodyJson,
-			factorSecret: args.factorSecret,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			recoveryLifecycleId: recoveryRequest.scope.lifecycle_id,
-			yaoAdmission: admitted.receipt,
-			yaoApplication: admitted.request.application_binding,
-			participantIds: args.recoveryBasis.participantIds,
-			registeredPublicKeyB64u: base64UrlEncode(Uint8Array.from(args.recoveryBasis.registeredPublicKey)),
-			runRouterRound: (executeRequestJson) => executeWalletRecoveryEd25519RoundV1({
-				executeRequestJson,
-				transport
-			}),
-			activateRouterRecovery: (protocolResultJson) => activateWalletRecoveryEd25519V1({
-				request: recoveryRequest,
-				protocolResultJson,
-				transport
-			})
-		});
-		if (!rejoined.localMaterial) throw new Error("the wallet custody NEAR cold rejoin produced no local signing material");
-		return {
-			commitPayload: rejoined.commitPayload,
-			activationReference: rejoined.activationReference,
-			localMaterial: rejoined.localMaterial,
-			metadata: walletRecoveryEd25519ActiveClientMetadataV1({
-				admissionRequest: recoveryRequest,
-				activationResultJson: rejoined.activationResultJson,
-				activationReceipt: rejoined.activationReceipt
-			})
-		};
-	}
-	async establishWalletCustodyEvmFamilyKeySet(args) {
-		return await establishEvmFamilyCustodyV1({
-			...args,
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1())
-		});
-	}
-	async joinWalletCustodyEvmFamilyKeySet(args) {
-		return await joinEvmFamilyCustodyV1({
-			...args,
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1())
-		});
-	}
-	async rejoinWalletCustodyEvmFamilyKeySet(args) {
-		return await rejoinEvmFamilyCustodyV1({
-			...args,
-			runStep: walletCustodyCeremonyStepRunner(this.walletCustodyCeremonyTransportV1())
-		});
-	}
-	async restoreWalletCustodyEcdsaContinuity(args) {
-		const imported = await importWalletCustodyEcdsaContinuity({
-			...args,
-			store: new IndexedDbEcdsaCapabilityManifestStore()
-		});
-		if (imported.kind !== "committed") throw new Error(`wallet custody ECDSA import returned ${imported.kind}`);
-		const materialActivation = routerAbMpcMaterialActivationRefFromWire(args.publicCapability.material_activation);
-		const opened = await openEcdsaRoleLocalSigningMaterialWasm({
-			workerCtx: this.signerWorkerManager.getContext(),
-			authority: args.authority,
-			materialActivation
-		});
-		if (!opened.ok) throw new Error(`wallet custody ECDSA material open returned ${opened.reason}`);
-		return {
-			materialActivation,
-			materialRef: opened.materialRef
-		};
-	}
-	async persistWalletCustodyEd25519Material(args) {
-		await persistWalletCustodyEd25519MaterialV1({
-			store: this.signerWorkerManager.getContext().nearKeyMaterialStore,
-			binding: args.binding,
-			sealed: args.sealed
-		});
-	}
-	async loadWalletCustodyEd25519Material(args) {
-		return await loadWalletCustodyEd25519MaterialV1({
-			store: this.signerWorkerManager.getContext().nearKeyMaterialStore,
-			nearAccountId: args.nearAccountId,
-			signerSlot: args.signerSlot,
-			expectedRegisteredPublicKeyB64u: args.expectedRegisteredPublicKeyB64u
-		});
-	}
-	async loadEmailOtpWalletCustodyEd25519Material(args) {
-		const loaded = await this.loadWalletCustodyEd25519Material({
-			nearAccountId: args.nearAccountId,
-			signerSlot: args.signerSlot,
-			expectedRegisteredPublicKeyB64u: ""
-		});
-		return loaded.kind === "found" ? loaded : { kind: "absent" };
-	}
-	async deleteWalletCustodyEd25519Material(args) {
-		await deleteWalletCustodyEd25519MaterialV1({
-			store: this.signerWorkerManager.getContext().nearKeyMaterialStore,
-			nearAccountId: args.nearAccountId,
-			signerSlot: args.signerSlot
-		});
-	}
-	async assertSealedRefreshStartupParity() {
-		await this.ensureSealedRefreshStartupParity();
-	}
-	async discoverPersistedSessionsForWallet(args) {
-		return await discoverPersistedSessionsForWallet(this.sessionPublicDeps, args);
-	}
-	isEd25519YaoPublicCapabilityActive(reference) {
-		switch (reference.auth.kind) {
-			case WALLET_AUTH_METHODS.emailOtp: return true;
-			case WALLET_AUTH_METHODS.passkey: return this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId: reference.walletId,
-				nearAccountId: reference.nearAccountId,
-				materialActivation: reference.materialActivation
-			}) !== null;
-			default:
-				reference.auth;
-				throw new Error("Unsupported Ed25519 public capability auth method");
-		}
-	}
-	async readPersistedAvailableSigningLanes(args) {
-		return await readPersistedAvailableSigningLanes(this.sessionPublicDeps, args);
-	}
-	async readOwnerScopedSigningLanes(args, statusReads) {
-		return await readOwnerScopedSigningLanes(this.sessionPublicDeps, args, statusReads);
-	}
-	/**
-	* Resolves the selected active Wallet Authority and auth method to one exact
-	* owner scope. Session availability is resolved by the lane inventory so an
-	* expired session can enter operation step-up.
-	*/
-	async resolveSelectedOwnerLaneScope(walletId) {
-		const parsedWalletId = parseWalletId(walletId);
-		if (!parsedWalletId.ok) throw new Error(parsedWalletId.error.message);
-		const stores = {
-			getWalletAuthMethodV2: (id) => IndexedDBManager.getWalletAuthMethodV2(id),
-			listWalletAuthMethodsForWallet: (id) => IndexedDBManager.listWalletAuthMethodsForWallet(id),
-			getWalletPasskeyAuthenticator: (input) => IndexedDBManager.getWalletPasskeyAuthenticator(input),
-			readEmailOtpProviderSubjectForWallet: (id) => readEmailOtpProviderSubjectForWalletV1(IndexedDBManager, id)
-		};
-		const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(parsedWalletId.value));
-		if (selected.kind === "resolved") {
-			const { selection, authMethod, authority } = selected;
-			if (selection.walletId !== parsedWalletId.value || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletId !== parsedWalletId.value || authMethod.walletAuthorityId !== authority.authorityId || authority.walletId !== parsedWalletId.value) throw new Error("[SigningEngine] selected Wallet Authority identity mismatch");
-			if (selection.lockState !== "unlocked") throw fullWalletLoginRequired("wallet_locked");
-			if (authMethod.status !== "active") throw fullWalletLoginRequired("method_unavailable");
-			if (authority.state !== "active") throw fullWalletLoginRequired("authority_unavailable");
-			if (authority.provenance.kind === "device_link" && authMethod.kind === "passkey" && authority.signerActivations.ed25519) return buildExactPasskeyOwnerLaneScope({
-				authMethod,
-				signerSlot: await resolveLinkedPasskeyOwnerSignerSlot({
-					walletId: parsedWalletId.value,
-					authMethod,
-					signerMaterials: selected.signerMaterials,
-					publicLaneStore: this.ed25519YaoPublicCapabilityReferences
-				})
-			});
-			if (authority.provenance.kind === "device_link" && authMethod.kind === "passkey" && authority.signerActivations.ecdsa) return buildExactEcdsaPasskeyOwnerLaneScope({ authMethod });
-			if (authority.provenance.kind === "device_link" && authMethod.kind === "email_otp" && authority.signerActivations.ecdsa) {
-				const holderRuntime = resolveLinkedEcdsaHolderRuntimeV1({
-					walletId: parsedWalletId.value,
-					materialActivation: authority.signerActivations.ecdsa.materialActivation
-				});
-				if (!holderRuntime || holderRuntime.authorityId !== authority.authorityId || !isEmailOtpWalletAuthAuthority(holderRuntime.factorAuthority)) throw new Error("[SigningEngine] selected linked Email OTP authority has no exact ECDSA holder runtime");
-				const authorityRef = await walletAuthAuthorityRef({ authority: holderRuntime.factorAuthority });
-				if (authorityRef.walletId !== parsedWalletId.value || authorityRef.walletAuthMethodId !== authMethod.walletAuthMethodId) throw new Error("[SigningEngine] selected linked Email OTP authority has no exact ECDSA holder runtime");
-				return buildExactLinkedEmailOtpOwnerLaneScope({
-					authMethod,
-					factorAuthority: holderRuntime.factorAuthority,
-					authorityRef
-				});
-			}
-			return await resolveExactOwnerLaneScope({
-				authMethod,
-				stores
-			});
-		}
-		const reason = selected.kind === "integrity_error" ? `: ${selected.reason}` : "";
-		throw new Error(`[SigningEngine] selected Wallet Authority is ${selected.kind}${reason}`);
-	}
-	readWalletAuthenticationState() {
-		return this.walletAuthenticationState;
-	}
-	async retireActiveWalletSessionAuthorizationForLock(walletId) {
-		const retiredAtMs = Date.now();
-		if ((await walletSessionAuthorizations.retireExactActiveForWallet({
-			walletId,
-			reason: "wallet_locked",
-			retiredAtMs
-		})).length > 0) this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({
-			kind: "wallet",
-			walletId: String(walletId)
-		});
-	}
-	async advanceWalletLockGeneration(walletId) {
-		return IndexedDBManager.advanceWalletLockGeneration({
-			walletId,
-			lockedAtMs: Date.now()
-		});
-	}
-	async markWalletSelectionUnlocked(input) {
-		await IndexedDBManager.markWalletSelectionUnlocked({
-			walletId: input.walletId,
-			walletAuthMethodId: input.walletAuthMethodId,
-			unlockedAtMs: Date.now()
-		});
-	}
-	async markSelectedEmailOtpWalletAuthorityUnlocked(input) {
-		await this.markWalletSelectionUnlocked(input);
-	}
-	/**
-	* Every route that lands a wallet in the authenticated state goes through
-	* here — passkey unlock, email OTP login, the hosted auth menu, and session
-	* restore. Binding the preferences manager at this choke point is what makes
-	* per-wallet preferences real: without it the manager stays on "no last
-	* user", so reads answer the built-in defaults while the wallet's persisted
-	* choices sit unread, and writes stay memory-only and evaporate on reload —
-	* the Confirmer UI toggle looked applied but silently reverted every page
-	* load. setCurrentWallet also notifies, which pushes PREFERENCES_CHANGED to
-	* the app origin so its mirrored uiMode follows the wallet too.
-	*/
-	applyAuthenticatedWalletState(state) {
-		this.walletAuthenticationState = state;
-		this.userPreferencesManager.setCurrentWallet(state.walletId);
-	}
-	setWalletAuthenticated(state) {
-		const previous = this.walletAuthenticationState;
-		if (previous.kind === "authenticated" && String(previous.walletId) !== String(state.walletId)) this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({
-			kind: "wallet",
-			walletId: String(previous.walletId)
-		});
-		this.walletAuthenticationRestoreGeneration += 1;
-		this.applyAuthenticatedWalletState(state);
-	}
-	clearWalletAuthentication() {
-		this.walletAuthenticationRestoreGeneration += 1;
-		this.walletAuthenticationState = { kind: "signed_out" };
-		this.destroyUnlockedWalletEd25519ExportRootCapabilitiesV1({ kind: "all" });
-	}
-	clearWalletAuthenticationIfCurrent(expected) {
-		if (this.walletAuthenticationState !== expected) return false;
-		this.clearWalletAuthentication();
-		return true;
-	}
-	/**
-	* The wallet custody ceremony worker as the small structural port the
-	* custody modules take, so they can be exercised without a worker.
-	*/
-	walletCustodyCeremonyTransportV1() {
-		const workerContext = this.getSignerWorkerContext();
-		return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
-	}
-	/**
-	* Parks the wallet custody seed inside the ceremony worker for the lifetime of
-	* the just-activated owner Wallet Session, reusing the factor secret this
-	* registration or unlock already collected. Failure is absorbed: the wallet
-	* stays usable, and device linking fails closed with `wallet_unlock_required`
-	* until the next unlock.
-	*/
-	async establishUnlockedWalletEd25519ExportRootCapabilityV1(input) {
-		try {
-			const binding = input.existingEnvelope.binding;
-			if (!isWalletCustodySeedBinding(binding) && binding.kind !== "ed25519_yao_client_root_v1") return;
-			if (input.existingEnvelope.factor.kind !== "passkey") throw new Error("unlocked export-root capability requires a passkey envelope factor");
-			const existingFactorSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
-			try {
-				await establishUnlockedWalletEd25519ExportRootCapabilityV1(this.walletCustodyCeremonyTransportV1(), {
-					existingEnvelope: input.existingEnvelope,
-					existingFactorSecret,
-					walletId: input.walletId,
-					walletAuthMethodId: input.walletAuthMethodId,
-					walletSessionId: input.walletSessionId,
-					expiresAtMs: input.expiresAtMs
-				});
-			} finally {
-				existingFactorSecret.fill(0);
-			}
-		} catch (error) {
-			console.warn("[BrowserSigningSurface] unlocked Ed25519 export-root capability was not established:", error instanceof Error ? error.message : String(error || "unknown error"));
-		}
-	}
-	/**
-	* Stores the reseal of an unbound envelope under the method that opened it.
-	*
-	* Absorbed the same way establishment is, and for the same reason: the V2 row
-	* still opens the wallet, so a failure here costs a retry at the next unlock
-	* and nothing else. Surfacing it would interrupt a user who has no action to
-	* take.
-	*/
-	async persistUpgradedWalletCustodyEnvelopeV1(upgrade) {
-		try {
-			const relayerUrl = String(this.seamsWebConfigs.network.relayer?.url || "").trim();
-			if (!relayerUrl) return;
-			const parsedWalletId = parseWalletId(upgrade.walletId);
-			if (!parsedWalletId.ok) return;
-			const walletSessionToken = (await resolveActiveEd25519WalletSessionAuthorization(parsedWalletId.value, relayerUrl))?.operationCredential.token;
-			if (!walletSessionToken) return;
-			const outcome = await upgradeWalletCustodyEnvelopeOwnership({
-				relayUrl: relayerUrl,
-				walletId: upgrade.walletId,
-				walletSessionToken: String(walletSessionToken),
-				envelope: upgrade.envelope
-			});
-			if (outcome.kind === "upgraded" || outcome.kind === "already_owned") return;
-			console.warn("[BrowserSigningSurface] the upgraded custody envelope was not stored:", outcome.message);
-		} catch (error) {
-			console.warn("[BrowserSigningSurface] the upgraded custody envelope was not stored:", error instanceof Error ? error.message : String(error || "unknown error"));
-		}
-	}
-	async destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(scope) {
-		await destroyUnlockedWalletEd25519ExportRootCapabilitiesV1(this.walletCustodyCeremonyTransportV1(), scope);
-	}
-	async runWarmCriticalResources(accountContext) {
-		try {
-			await this.ensureSealedRefreshStartupParity();
-		} catch (error) {
-			if (!isRetryableSealedRefreshCapabilityFetchError(error)) throw error;
-			console.warn("[BrowserSigningSurface] warmCriticalResources skipped retryable sealed-refresh capability fetch failure", error instanceof Error ? error.message : String(error || "unknown error"));
-		}
-		return await this.enginePorts.getManagerConveniencePorts().warmCriticalResources(accountContext);
-	}
-	async warmCriticalResources(accountContext) {
-		if (__isWalletIframeHostMode() && accountContext === void 0) {
-			const existing = this.hostWarmCriticalResourcesTask;
-			if (existing) return await existing;
-			const task = this.runWarmCriticalResources();
-			this.hostWarmCriticalResourcesTask = task;
-			task.catch(() => {
-				if (this.hostWarmCriticalResourcesTask === task) this.hostWarmCriticalResourcesTask = null;
-			});
-			return await task;
-		}
-		return await this.runWarmCriticalResources(accountContext);
-	}
-	async prewarmEmailOtpYao(request) {
-		return await this.signerWorkerManager.prewarmEmailOtpYao(request);
-	}
-	async prewarmEcdsaRegistrationCrypto() {
-		return await this.signerWorkerManager.prewarmEcdsaRegistrationCrypto();
-	}
-	getRpId() {
-		return this.touchIdPrompt.getRpId();
-	}
-	getSignerWorkerContext() {
-		return this.enginePorts.walletSessionActivationDeps.getSignerWorkerContext();
-	}
-	getNonceCoordinator() {
-		return this.nonceCoordinator;
-	}
-	setAppearance(appearance) {
-		this.appearance = appearance;
-	}
-	setWalletIframeSurfaceMeasurementBinding(binding) {
-		this.touchConfirm.getContext().surfaceMeasurementBinding = binding;
-	}
-	getWalletIframeSurfaceMeasurementBinding() {
-		return this.touchConfirm.getContext().surfaceMeasurementBinding;
-	}
-	getUserPreferences() {
-		return this.userPreferencesManager;
-	}
-	async signNear(request) {
-		const walletId = request.args.commandSubject.walletSession.walletId;
-		try {
-			return await signNear(this.enginePorts.nearSigningDeps, request);
-		} catch (error) {
-			if (isWalletSigningStateFailure(error)) {
-				await this.terminateWalletStateAfterSigningFailure(walletId);
-				throw error;
-			}
-			throw error;
-		}
-	}
-	async terminateWalletStateAfterSigningFailure(walletId) {
-		const authentication = this.readWalletAuthenticationState();
-		let authenticationCleared = false;
-		try {
-			await this.advanceWalletLockGeneration(walletId);
-		} catch {}
-		try {
-			await this.retireActiveWalletSessionAuthorizationForLock(walletId);
-		} catch {}
-		try {
-			authenticationCleared = this.clearWalletAuthenticationIfCurrent(authentication);
-		} catch {}
-		if (authenticationCleared) {
-			try {
-				this.nonceCoordinator.clearAll();
-			} catch {}
-			try {
-				this.clearThresholdEcdsaSigningQueue();
-			} catch {}
-		}
-		try {
-			await this.clearVolatileWarmSigningMaterial(walletId);
-		} catch {}
-	}
-	async ensureNearEd25519YaoCapabilityForSigning(subject) {
-		const rehydrationKey = nearEd25519CapabilityRehydrationKey(subject);
-		const existingRehydration = this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey);
-		if (existingRehydration) {
-			const rebound = await existingRehydration;
-			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(rebound.subject);
-			if (rehydrated) return rehydrated;
-			throw new Error("[SigningEngine][near] joined rehydration did not publish an active lane");
-		}
-		const rehydration = this.rehydrateNearEd25519YaoCapabilityForSigning(subject);
-		this.nearEd25519CapabilityRehydrationBySubject.set(rehydrationKey, rehydration);
-		try {
-			return (await rehydration).material;
-		} finally {
-			if (this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey) === rehydration) this.nearEd25519CapabilityRehydrationBySubject.delete(rehydrationKey);
-		}
-	}
-	async rehydrateExactPasskeyEd25519YaoCapabilityForSigning(args) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(args);
-		return await this.ensureNearEd25519YaoCapabilityForSigning(args.laneIdentity !== void 0 ? {
-			kind: "exact_lane",
-			laneIdentity: args.laneIdentity
-		} : {
-			kind: "material_identity",
-			materialIdentity: identity
-		});
-	}
-	async prepareMaterialIdentityNearEd25519YaoSigning(args) {
-		const identity = args.materialIdentity;
-		const activeForAccount = this.enginePorts.ed25519YaoActiveClients.resolveForWalletAccount({
-			walletId: identity.signer.account.wallet.walletId,
-			nearAccountId: identity.signer.account.nearAccountId
-		});
-		const publicCapabilityMaterialActivation = await resolveNearEd25519PublicCapabilityMaterialActivation({
-			store: this.ed25519YaoPublicCapabilityReferences,
-			identity
-		});
-		const passkeyAuthorizationRead = identity.auth.kind === WALLET_AUTH_METHODS.passkey ? await this.readExactNearEd25519WalletSessionAuthorization(args.walletId) : null;
-		const passkeyAuthorization = passkeyAuthorizationRead ? classifyNearEd25519WalletSessionAuthorization(passkeyAuthorizationRead) : null;
-		if (identity.auth.kind === WALLET_AUTH_METHODS.passkey && publicCapabilityMaterialActivation) {
-			const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId: identity.signer.account.wallet.walletId,
-				nearAccountId: identity.signer.account.nearAccountId,
-				materialActivation: publicCapabilityMaterialActivation
-			});
-			const liveRuntime = nearEd25519YaoRuntimeObservation(activeMaterial);
-			if (activeMaterial && liveRuntime.kind === "live") {
-				if (passkeyAuthorization?.kind === "authorized") {
-					const authorization = passkeyAuthorization.authorization;
-					if (authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] active Wallet Session method is unavailable");
-					return await buildAuthorizedNearEd25519YaoSigningPreparation({
-						hydration: buildUseLiveRuntimeHydrationPlan({
-							authority: await walletAuthAuthorityRef({ authority: authorization.selectedFactorAuthority }),
-							runtime: liveRuntime.runtime,
-							materialActivation: publicCapabilityMaterialActivation
-						}),
-						requirement: identity.auth,
-						authorization
-					});
-				}
-				if (passkeyAuthorization?.kind !== "operation_step_up") {
-					if (passkeyAuthorization?.kind === "full_login_required") throw fullWalletLoginRequired(passkeyAuthorization.reason);
-					throw new Error("[SigningEngine][near] Wallet Session status is temporarily unavailable");
-				}
-			}
-		}
-		if (passkeyAuthorization?.kind === "full_login_required") throw fullWalletLoginRequired(passkeyAuthorization.reason);
-		if (passkeyAuthorization?.kind === "temporarily_unavailable") throw new Error("[SigningEngine][near] Wallet Session persistence is temporarily unavailable");
-		if (identity.auth.kind === WALLET_AUTH_METHODS.passkey && passkeyAuthorization?.kind === "operation_step_up") return buildAuthorizationRequiredNearEd25519YaoSigningPreparation({
-			hydration: (await preparePasskeyEd25519OperationMaterial({
-				walletId: args.walletId,
-				identity,
-				relayerUrl: this.seamsWebConfigs.network.relayer.url
-			})).prepared.plan,
-			requirement: identity.auth
-		});
-		const sealedRuntime = identity.auth.kind === WALLET_AUTH_METHODS.passkey ? await requireExactEd25519SealedRuntimeForMaterialIdentity({
-			walletId: args.walletId,
-			identity
-		}) : null;
-		const materialActivation = sealedRuntime?.sealedRecord.ed25519Restore.materialActivation ?? (activeForAccount ? nearEd25519YaoMaterialActivationFromMetadata(activeForAccount.activeClient.metadata()) : publicCapabilityMaterialActivation);
-		if (!materialActivation) throw invalidWalletSigningMaterial("missing_capability");
-		const runtimeObservation = nearEd25519YaoRuntimeObservation(this.enginePorts.ed25519YaoActiveClients.resolve({
-			walletId: identity.signer.account.wallet.walletId,
-			nearAccountId: identity.signer.account.nearAccountId,
-			materialActivation
-		}));
-		let hydration;
-		switch (identity.auth.kind) {
-			case WALLET_AUTH_METHODS.passkey: {
-				if (!sealedRuntime) throw invalidWalletSigningMaterial("missing_runtime");
-				if (passkeyAuthorization?.kind !== "authorized") throw new Error("[SigningEngine][near] exact Passkey authorization is unavailable");
-				const authorizationRead = {
-					kind: "found",
-					authorization: passkeyAuthorization.authorization
-				};
-				const walletSessionState = await rebindRouterAbEd25519WalletSessionStateFromExactRuntime({
-					runtime: sealedRuntime,
-					authorization: passkeyAuthorization.authorization,
-					nowMs: Date.now()
-				});
-				const warmSessionClaim = await this.ensurePasskeyEd25519WarmSessionForSigning({
-					runtime: sealedRuntime,
-					walletSessionState,
-					materialActivation
-				});
-				let authority;
-				try {
-					authority = await resolveBrowserNearEd25519PasskeyAuthorityForMaterial({
-						walletId: args.walletId,
-						runtime: sealedRuntime,
-						authorizationRead
-					});
-				} catch {
-					throw invalidWalletSigningMaterial("binding_mismatch");
-				}
-				const localMaterialIdentity = passkeyEd25519LocalMaterialIdentityFromExactRuntime(sealedRuntime);
-				const localMaterial = await readPasskeyEd25519YaoLocalMaterialLocatorV1({
-					store: IndexedDBManager,
-					walletId: String(identity.signer.account.wallet.walletId),
-					nearAccountId: String(identity.signer.account.nearAccountId),
-					nearEd25519SigningKeyId: String(identity.signer.nearEd25519SigningKeyId),
-					signerSlot: identity.signer.signerSlot,
-					rpId: identity.auth.rpId,
-					credentialIdB64u: identity.auth.credentialIdB64u,
-					authority
-				});
-				const publicLocator = {
-					kind: "available",
-					walletId: String(identity.signer.account.wallet.walletId),
-					nearAccountId: String(identity.signer.account.nearAccountId),
-					signerSlot: identity.signer.signerSlot,
-					materialActivation,
-					authority
-				};
-				hydration = resolveNearEd25519YaoCapabilityHydrationV1({
-					publicLocator,
-					sealed: localMaterial.kind === "available" ? {
-						kind: "available",
-						authority: localMaterial.locator.authority,
-						materialActivation: localMaterial.locator.materialActivation,
-						sealedMaterial: localMaterial.locator.sealedMaterial
-					} : { kind: "missing" },
-					runtime: runtimeObservation,
-					unlockSource: warmSessionClaim.ok ? {
-						kind: "available",
-						authority
-					} : { kind: "unavailable" }
-				});
-				if (hydration.kind === "blocked" && hydration.reason === "missing_material") hydration = (await prepareExactPasskeyEd25519YaoLocalMaterialRehydration({
-					store: IndexedDBManager,
-					identity: localMaterialIdentity,
-					authority,
-					publicLocator
-				})).plan;
-				break;
-			}
-			case WALLET_AUTH_METHODS.emailOtp:
-				hydration = await this.resolveWalletCustodyEmailOtpHydration({
-					walletId: args.walletId,
-					nearAccountId: args.nearAccountId,
-					identity: requireEmailOtpNearEd25519MaterialIdentity(identity),
-					signerSlot: identity.signer.signerSlot,
-					materialActivation
-				});
-				break;
-			default:
-				identity.auth;
-				throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-		}
-		if (hydration.kind === "blocked") {
-			if (hydration.reason === "persistence_unavailable") throw new Error("[SigningEngine][near] signing material persistence is unavailable");
-			throw walletSigningMaterialBlockError(hydration.reason);
-		}
-		return buildAuthorizationRequiredNearEd25519YaoSigningPreparation({
-			hydration,
-			requirement: identity.auth
-		});
-	}
-	async resolveWalletCustodyEmailOtpHydration(args) {
-		const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId,
-			materialActivation: args.materialActivation
-		});
-		const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-		let authority;
-		if (authorizationRead.kind === "found") {
-			if (authorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.emailOtp) return buildBlockedMpcCapabilityHydrationPlan({
-				capability: args.materialActivation.capability,
-				reason: "missing_material"
-			});
-			authority = await walletAuthAuthorityRef({ authority: authorizationRead.authorization.selectedFactorAuthority });
-			if (activeMaterial) return buildUseLiveRuntimeHydrationPlan({
-				authority,
-				runtime: nearEd25519YaoRuntimeRef(args.materialActivation),
-				materialActivation: args.materialActivation
-			});
-		} else if (authorizationRead.kind === "exhausted") {
-			const exhaustedAuthority = await resolveBrowserNearEd25519EmailOtpAuthorityForMaterial({
-				walletId: args.walletId,
-				nearAccountId: args.nearAccountId,
-				identity: args.identity,
-				signerSlot: args.signerSlot,
-				materialActivation: args.materialActivation,
-				authorizationRead: { kind: "exhausted" }
-			});
-			if (!exhaustedAuthority) return buildBlockedMpcCapabilityHydrationPlan({
-				capability: args.materialActivation.capability,
-				reason: "missing_material"
-			});
-			authority = exhaustedAuthority;
-			if (activeMaterial) try {
-				validateExactNearEd25519YaoOperationMaterial({
-					material: activeMaterial,
-					input: {
-						walletId: args.walletId,
-						nearAccountId: args.nearAccountId,
-						materialIdentity: args.identity
-					},
-					expectedActivation: args.materialActivation
-				});
-			} catch {
-				return buildBlockedMpcCapabilityHydrationPlan({
-					capability: args.materialActivation.capability,
-					reason: "binding_mismatch"
-				});
-			}
-		} else return buildBlockedMpcCapabilityHydrationPlan({
-			capability: args.materialActivation.capability,
-			reason: "missing_material"
-		});
-		if (activeMaterial) return buildUseLiveRuntimeHydrationPlan({
-			authority,
-			runtime: nearEd25519YaoRuntimeRef(args.materialActivation),
-			materialActivation: args.materialActivation
-		});
-		const loaded = await this.loadEmailOtpWalletCustodyEd25519Material({
-			nearAccountId: String(args.nearAccountId),
-			signerSlot: args.signerSlot
-		});
-		if (loaded.kind === "found" && loaded.material.binding.walletId === String(args.walletId) && loaded.material.binding.nearAccountId === String(args.nearAccountId) && loaded.material.binding.signerSlot === args.signerSlot && String(args.materialActivation.materialOwner) === String(args.walletId) && (authorizationRead.kind === "found" || loaded.material.binding.nearEd25519SigningKeyId === String(args.identity.signer.nearEd25519SigningKeyId) && loaded.material.binding.signingWorkerId === String(args.materialActivation.signingWorker))) return buildRehydrateMaterialActivationHydrationPlan({
-			authority,
-			materialActivation: args.materialActivation,
-			sealedMaterial: buildRestorableMpcMaterialRefForHydration(JSON.stringify([
-				loaded.material.binding.walletId,
-				loaded.material.binding.nearAccountId,
-				loaded.material.binding.signerSlot,
-				args.materialActivation.activationId
-			]))
-		});
-		return buildBlockedMpcCapabilityHydrationPlan({
-			capability: args.materialActivation.capability,
-			reason: "missing_material"
-		});
-	}
-	async rehydrateActiveEmailOtpEd25519YaoSessionMaterial(args) {
-		const input = requireAuthorizedNearEd25519BoundaryInput(args.input);
-		if (input.auth.kind !== WALLET_AUTH_METHODS.emailOtp) throw new Error("[SigningEngine][near] Email OTP session restore requires Email OTP material");
-		const publicLane = await resolveExactEmailOtpPublicLaneReference({
-			store: this.ed25519YaoPublicCapabilityReferences,
-			laneIdentity: input.laneIdentity,
-			materialActivation: args.materialActivation
-		});
-		const user = await this.getUserBySignerSlot(input.nearAccountId, input.laneIdentity.signer.signerSlot);
-		if (!user || String(user.walletId) !== String(input.walletId) || String(user.nearAccountId) !== String(input.nearAccountId) || user.signerSlot !== input.laneIdentity.signer.signerSlot || user.authMethod !== WALLET_AUTH_METHODS.emailOtp) throw new Error("[SigningEngine][near] Email OTP signer record is unavailable");
-		const sealed = await this.loadEmailOtpWalletCustodyEd25519Material({
-			nearAccountId: String(input.nearAccountId),
-			signerSlot: user.signerSlot
-		});
-		const operationCredential = args.authorization.operationCredential;
-		if (sealed.kind !== "found") throw new Error("[SigningEngine][near] Email OTP session material is unavailable");
-		const ecdsaManifest = requireEmailOtpEcdsaRehydrationManifest(await listBrowserActiveEcdsaCapabilityManifestsForWallet(String(input.walletId)), String((await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority })).authorityDigest));
-		const ecdsaSessionPolicy = buildEmailOtpEcdsaRehydrationPolicy({
-			manifest: ecdsaManifest,
-			remainingUses: args.remainingUses
-		});
-		const activated = await this.signerWorkerManager.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "rehydrateActiveEmailOtpEd25519YaoSessionMaterial",
-				payload: {
-					relayUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim(),
-					walletId: String(input.walletId),
-					walletAuthMethodId: String(args.authorization.selectedAuthMethod.walletAuthMethodId),
-					orgId: publicLane.runtimePolicyScope.orgId,
-					providerSubjectId: input.auth.providerSubjectId,
-					nearAccountId: String(input.nearAccountId),
-					signerSlot: user.signerSlot,
-					remainingUses: args.remainingUses,
-					expectedOperationalPublicKey: user.operationalPublicKey,
-					expectedThresholdSessionId: publicLane.thresholdSessionId,
-					operationCredential,
-					ecdsa: {
-						sessionHandleBinding: {
-							operation: "wallet_unlock",
-							keyHandle: String(ecdsaManifest.durableMaterial.roleLocalBinding.keyHandle),
-							authSubjectId: input.auth.providerSubjectId,
-							chainTarget: ecdsaManifest.signer.scope.targetMemberships[0]
-						},
-						runtimePolicyScope: ecdsaManifest.durableMaterial.runtimePolicyScope,
-						sessionPolicy: ecdsaSessionPolicy
-					},
-					walletCustodyEd25519Material: sealed
-				}
-			}
-		});
-		await persistRehydratedEmailOtpEcdsaWalletSession({
-			walletId: input.walletId,
-			authorization: activated.walletSessionAuthorization,
-			response: activated.ecdsaSession
-		});
-		await this.activateEmailOtpEd25519CustodyCapabilityInternal({
-			commitQueue: "acquire",
-			walletSession: {
-				walletId: input.walletId,
-				walletSessionUserId: String(input.walletId)
-			},
-			providerSubject: input.auth.providerSubjectId,
-			emailHashHex: await sha256HexUtf8(user.loginDisplayName.trim().toLowerCase()),
-			signerSlot: user.signerSlot,
-			expectedOperationalPublicKey: user.operationalPublicKey,
-			expectedThresholdSessionId: String(publicLane.thresholdSessionId),
-			bootstrap: activated.bootstrap,
-			activeClientHandle: activated.activeClientHandle,
-			metadata: activated.metadata,
-			exactAuthorization: activated.walletSessionAuthorization
-		});
-		return buildUseLiveRuntimeHydrationPlan({
-			authority: await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority }),
-			runtime: nearEd25519YaoRuntimeRef(args.materialActivation),
-			materialActivation: args.materialActivation
-		});
-	}
-	async prepareExactNearEd25519YaoSigning(args) {
-		if (args.laneIdentity !== void 0 && args.auth?.kind === WALLET_AUTH_METHODS.emailOtp) {
-			let preparation = await this.prepareMaterialIdentityNearEd25519YaoSigning(authNeutralNearEd25519BoundaryInput(args));
-			const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-			if (authorizationRead.kind !== "found" || authorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.emailOtp) return preparation;
-			const authorization = authorizationRead.authorization;
-			switch (preparation.hydration.kind) {
-				case "use_live_runtime": break;
-				case "rehydrate_material_activation":
-					preparation = buildAuthorizationRequiredNearEd25519YaoSigningPreparation({
-						hydration: await this.rehydrateActiveEmailOtpEd25519YaoSessionMaterial({
-							input: args,
-							materialActivation: preparation.hydration.materialActivation,
-							authorization,
-							remainingUses: authorization.status.remainingUses
-						}),
-						requirement: args.auth
-					});
-					break;
-				case "reauthorize_public_anchor":
-				case "blocked": return preparation;
-				default:
-					preparation.hydration;
-					throw new Error("[SigningEngine][near] unsupported Email OTP hydration state");
-			}
-			const currentAuthorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-			if (currentAuthorizationRead.kind !== "found" || currentAuthorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.emailOtp) return preparation;
-			return await buildAuthorizedNearEd25519YaoSigningPreparation({
-				hydration: preparation.hydration,
-				requirement: args.auth,
-				authorization: currentAuthorizationRead.authorization
-			});
-		}
-		if (args.laneIdentity === void 0) return await this.prepareMaterialIdentityNearEd25519YaoSigning(args);
-		const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-		switch (authorizationRead.kind) {
-			case "found": {
-				const authorization = authorizationRead.authorization;
-				if (authorization.selectedAuthMethod.kind !== args.auth.kind) return await this.prepareMaterialIdentityNearEd25519YaoSigning(authNeutralNearEd25519BoundaryInput(args));
-				const sealedRuntimeResolution = await resolveExactEd25519SealedSessionRuntimeForLane({
-					walletId: args.walletId,
-					laneIdentity: args.laneIdentity
-				});
-				if (sealedRuntimeResolution.kind === "missing" && args.auth.kind === WALLET_AUTH_METHODS.passkey) {
-					const publicLane = await resolveExactPasskeyPublicLaneReference({
-						store: this.ed25519YaoPublicCapabilityReferences,
-						laneIdentity: args.laneIdentity
-					});
-					const materialActivation = publicLane.materialActivation;
-					const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-						walletId: args.walletId,
-						nearAccountId: args.nearAccountId,
-						materialActivation
-					});
-					if (!activeMaterial) throw new Error("[SigningEngine][near] active Passkey Ed25519 material is unavailable");
-					const material = validateExactNearEd25519YaoOperationMaterial({
-						material: activeMaterial,
-						input: args,
-						expectedActivation: materialActivation
-					});
-					const walletSessionState = await passkeyWalletSessionStateFromPublicLane({
-						reference: publicLane,
-						material,
-						authorization,
-						materialActivation,
-						relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-					});
-					const runtime = nearEd25519YaoRuntimeObservation(material);
-					if (runtime.kind !== "live") throw new Error("[SigningEngine][near] active Passkey Ed25519 material is unavailable");
-					return await buildAuthorizedNearEd25519YaoSigningPreparation({
-						hydration: buildUseLiveRuntimeHydrationPlan({
-							authority: walletSessionState.authority,
-							runtime: runtime.runtime,
-							materialActivation
-						}),
-						requirement: args.auth,
-						authorization
-					});
-				}
-				if (sealedRuntimeResolution.kind !== "resolved") throw new Error(`[SigningEngine][near] exact persisted Ed25519 runtime is ${sealedRuntimeResolution.kind}`);
-				const sealedRuntime = sealedRuntimeResolution.runtime;
-				const materialActivation = sealedRuntime.sealedRecord.ed25519Restore.materialActivation;
-				const walletSessionState = await walletSessionStateFromExactEd25519Runtime({
-					runtime: sealedRuntime,
-					relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-				});
-				const signer = walletSessionState.signingLane.identity.signer;
-				const publicLocator = {
-					kind: "available",
-					walletId: String(signer.account.wallet.walletId),
-					nearAccountId: String(signer.account.nearAccountId),
-					signerSlot: signer.signerSlot,
-					materialActivation
-				};
-				const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-					walletId: signer.account.wallet.walletId,
-					nearAccountId: signer.account.nearAccountId,
-					materialActivation
-				});
-				const warmSessionClaim = args.auth.kind === WALLET_AUTH_METHODS.passkey ? await this.passkeyMpcSession.claimWarmSessionMaterial({
-					thresholdSessionId: sealedRuntime.thresholdSessionId,
-					purpose: {
-						curve: "ed25519",
-						materialActivation
-					},
-					consume: false
-				}) : null;
-				let unlockSource = { kind: "unavailable" };
-				if (warmSessionClaim?.ok === true) unlockSource = {
-					kind: "available",
-					passkeyPrfFirstB64u: warmSessionClaim.prfFirstB64u
-				};
-				const hydration = await this.resolveExactNearEd25519YaoSigningHydration({
-					args,
-					walletSessionState,
-					publicLocator,
-					runtime: nearEd25519YaoRuntimeObservation(activeMaterial),
-					unlockSource
-				});
-				if (hydration.kind === "use_live_runtime") {
-					if (!activeMaterial) throw new Error("[SigningEngine][near] live Ed25519 material is unavailable");
-					await hydrateOwnerNearEd25519ExecutionLane({
-						input: args,
-						authorization,
-						sealedRuntime,
-						material: activeMaterial
-					});
-				}
-				return await buildAuthorizedNearEd25519YaoSigningPreparation({
-					hydration,
-					requirement: args.auth,
-					authorization
-				});
-			}
-			case "missing":
-			case "expired":
-			case "exhausted":
-			case "superseded":
-			case "authority_unavailable":
-			case "method_unavailable":
-			case "capability_unavailable":
-			case "unavailable": return await this.prepareMaterialIdentityNearEd25519YaoSigning(authNeutralNearEd25519BoundaryInput(args));
-			case "upgrade_required": throw new WalletSessionAuthorizationUpgradeRequiredError("[SigningEngine][near] Wallet Session authorization requires a newer client");
-			case "corrupt":
-			case "persistence_unavailable": throw new Error(`[SigningEngine][near] Wallet Session authorization is ${authorizationRead.kind}`);
-			default: throw new Error("[SigningEngine][near] unsupported Wallet Session authorization state");
-		}
-	}
-	async prepareExactNearEd25519YaoMaterialBoundary(args) {
-		assertNearEd25519YaoMaterialBoundaryAuth(args);
-		const preparation = await this.prepareExactNearEd25519YaoSigning(args);
-		const context = {
-			input: args,
-			materialActivation: preparation.hydration.materialActivation || null
-		};
-		return {
-			preparation,
-			executor: {
-				resolveSigningKeyMaterial: this.resolveExactNearEd25519SigningKeyMaterial.bind(this, context),
-				resolve: this.resolveExactNearEd25519YaoPreparedMaterial.bind(this, context),
-				resolveWalletSessionState: this.resolveExactNearEd25519YaoWalletSessionState.bind(this, context),
-				resolveFundingSession: this.resolveExactNearEd25519FundingSession.bind(this, context),
-				preparePasskeyOperationStepUp: this.prepareExactNearEd25519YaoOperationStepUpAtBoundary.bind(this, context),
-				prepareEmailOtpOperationStepUp: this.prepareExactNearEmailOtpEd25519YaoOperationStepUpAtBoundary.bind(this, context)
-			}
-		};
-	}
-	async resolveExactNearEd25519SigningKeyMaterial(context) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(context.input);
-		const signer = identity.signer;
-		const auth = identity.auth;
-		const materialActivation = context.materialActivation;
-		if (!materialActivation) throw new Error("[SigningEngine][near] prepared material has no activation");
-		if (String(signer.account.wallet.walletId) !== String(context.input.walletId) || String(signer.account.nearAccountId) !== String(context.input.nearAccountId)) throw new Error("[SigningEngine][near] selected Ed25519 lane identity changed");
-		const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(context.input.walletId));
-		if (selected.kind !== "resolved") {
-			const detail = selected.kind === "integrity_error" ? `: ${selected.reason}` : "";
-			throw new Error(`[SigningEngine][near] selected Wallet Authority is ${selected.kind}${detail}`);
-		}
-		const { selection, authMethod, authority, signerMaterials } = selected;
-		let authMethodMatches;
-		switch (auth.kind) {
-			case WALLET_AUTH_METHODS.passkey:
-				authMethodMatches = authMethod.kind === WALLET_AUTH_METHODS.passkey && String(authMethod.rpId) === String(auth.rpId) && authMethod.credentialIdB64u === auth.credentialIdB64u;
-				break;
-			case WALLET_AUTH_METHODS.emailOtp:
-				authMethodMatches = authMethod.kind === WALLET_AUTH_METHODS.emailOtp;
-				break;
-			default: throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-		}
-		if (selection.lockState !== "unlocked" || authority.state !== "active" || authMethod.status !== "active" || String(selection.walletId) !== String(context.input.walletId) || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletAuthorityId !== authority.authorityId || String(authMethod.walletId) !== String(context.input.walletId) || !authMethodMatches) throw new Error("[SigningEngine][near] selected Wallet Authority does not match the lane");
-		const operation = await resolveWalletAuthorityOperation({
-			selected: {
-				authMethod,
-				authority
-			},
-			operation: {
-				kind: "near_sign",
-				operation: "sign",
-				keyFamily: "ed25519"
-			}
-		});
-		if (operation.kind !== "resolved") throw new Error(`[SigningEngine][near] selected Wallet Authority rejected signing (${operation.reason.kind})`);
-		const resolved = operation.value;
-		if (resolved.keyFamily !== "ed25519" || String(resolved.walletId) !== String(context.input.walletId) || resolved.authMethodId !== authMethod.walletAuthMethodId || !mpcMaterialActivationRefsEqual(resolved.materialActivation, materialActivation)) throw new Error("[SigningEngine][near] selected Wallet Authority activation changed");
-		if (authority.signerActivations.keyFamilies[0] !== "ed25519" || authority.signerActivations.ed25519 === void 0 || !mpcMaterialActivationRefsEqual(authority.signerActivations.ed25519.materialActivation, materialActivation) || authority.signerActivations.ed25519.signer.registeredPublicKeyB64u !== resolved.registeredPublicKeyB64u) throw new Error("[SigningEngine][near] selected Ed25519 authority activation changed");
-		const registeredPublicKey = base64UrlDecode(resolved.registeredPublicKeyB64u);
-		if (registeredPublicKey.byteLength !== 32) throw new Error("[SigningEngine][near] selected Ed25519 public key is invalid");
-		const signingWorkerId = materialActivation.signingWorker;
-		let participantIds = [1, 2];
-		let linkedMaterial = null;
-		if (authority.provenance.kind === "device_link") {
-			await resolveExactNearEd25519PublicLaneReference({
-				store: this.ed25519YaoPublicCapabilityReferences,
-				identity,
-				materialActivation
-			});
-			for (const candidate of signerMaterials) {
-				if (!isLinkedEd25519SignerMaterial(candidate) || candidate.authorityId !== authority.authorityId || candidate.walletAuthMethodId !== authMethod.walletAuthMethodId || !mpcMaterialActivationRefsEqual(candidate.materialActivation, materialActivation)) continue;
-				if (linkedMaterial) throw new Error("[SigningEngine][near] linked Ed25519 signer material is ambiguous");
-				linkedMaterial = candidate;
-			}
-			if (!linkedMaterial) throw new Error("[SigningEngine][near] linked Ed25519 signer material is unavailable");
-			const application = linkedMaterial.publicFacts.applicationBinding;
-			const targetBinding = linkedMaterial.publicFacts.targetBinding;
-			const targetLifecycle = targetBinding.lifecycle;
-			const targetFactor = linkedMaterial.targetFactor;
-			let targetFactorMatches;
-			switch (auth.kind) {
-				case WALLET_AUTH_METHODS.passkey:
-					targetFactorMatches = targetFactor.kind === WALLET_AUTH_METHODS.passkey && targetFactor.walletAuthMethodId === authMethod.walletAuthMethodId && String(targetFactor.rpId) === String(auth.rpId) && targetFactor.credentialIdB64u === auth.credentialIdB64u;
-					break;
-				case WALLET_AUTH_METHODS.emailOtp:
-					targetFactorMatches = targetFactor.kind === WALLET_AUTH_METHODS.emailOtp && authMethod.kind === WALLET_AUTH_METHODS.emailOtp && targetFactor.walletAuthMethodId === authMethod.walletAuthMethodId && targetFactor.emailHashHex === authMethod.emailHashHex;
-					break;
-				default: throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-			}
-			if (application.wallet_id !== String(context.input.walletId) || application.near_ed25519_signing_key_id !== String(signer.nearEd25519SigningKeyId) || application.key_creation_signer_slot !== signer.signerSlot || targetLifecycle.account_id !== String(context.input.walletId) || targetLifecycle.session_id !== String(identity.thresholdSessionId) || targetLifecycle.selected_server_id !== String(signingWorkerId) || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(targetBinding.material_activation), materialActivation) || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(linkedMaterial.publicFacts.activationReceipt.material_activation), materialActivation) || base64UrlEncode(Uint8Array.from(linkedMaterial.publicFacts.activationReceipt.registered_public_key)) !== resolved.registeredPublicKeyB64u || !targetFactorMatches) throw new Error("[SigningEngine][near] linked Ed25519 signer identity changed");
-			participantIds = linkedMaterial.publicFacts.participantIds;
-		}
-		const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-			walletId: context.input.walletId,
-			nearAccountId: context.input.nearAccountId,
-			materialActivation
-		});
-		if (activeMaterial) {
-			const exactMaterial = validateExactNearEd25519YaoOperationMaterial({
-				material: activeMaterial,
-				input: context.input,
-				expectedActivation: materialActivation
-			});
-			const metadata = exactMaterial.activeClient.metadata();
-			const facts = exactMaterial.facts;
-			if (base64UrlEncode(metadata.registeredPublicKey) !== resolved.registeredPublicKeyB64u || metadata.participantIds[0] !== participantIds[0] || metadata.participantIds[1] !== participantIds[1] || metadata.applicationBinding.wallet_id !== String(context.input.walletId) || metadata.applicationBinding.near_ed25519_signing_key_id !== String(signer.nearEd25519SigningKeyId) || metadata.applicationBinding.key_creation_signer_slot !== signer.signerSlot || metadata.scope.account_id !== String(context.input.walletId) || metadata.scope.threshold_session_id !== String(identity.thresholdSessionId) || metadata.scope.signing_worker_id !== String(signingWorkerId) || facts.routerAbNormalSigning.signingWorkerId !== String(signingWorkerId) || facts.signingRootId !== metadata.applicationBinding.signing_root_id || facts.signingRootVersion !== metadata.scope.root_share_epoch) throw new Error("[SigningEngine][near] active Ed25519 public material changed");
-			if (linkedMaterial) {
-				const application = linkedMaterial.publicFacts.applicationBinding;
-				const targetLifecycle = linkedMaterial.publicFacts.targetBinding.lifecycle;
-				if (metadata.applicationBinding.wallet_id !== application.wallet_id || metadata.applicationBinding.near_ed25519_signing_key_id !== application.near_ed25519_signing_key_id || metadata.applicationBinding.signing_root_id !== application.signing_root_id || metadata.applicationBinding.key_creation_signer_slot !== application.key_creation_signer_slot || metadata.scope.lifecycle_id !== targetLifecycle.lifecycle_id || metadata.scope.root_share_epoch !== targetLifecycle.root_share_epoch || metadata.scope.account_id !== targetLifecycle.account_id || metadata.scope.threshold_session_id !== targetLifecycle.session_id || metadata.scope.signing_worker_id !== targetLifecycle.selected_server_id) throw new Error("[SigningEngine][near] linked Ed25519 runtime identity changed");
-			}
-		}
-		const publicKey = `ed25519:${base58Encode(registeredPublicKey)}`;
-		return {
-			nearAccountId: context.input.nearAccountId,
-			signerSlot: signer.signerSlot,
-			kind: "threshold_ed25519_v1",
-			publicKey,
-			relayerKeyId: signingWorkerId,
-			keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
-			participants: buildThresholdEd25519Participants2pV1({
-				clientParticipantId: participantIds[0],
-				relayerParticipantId: participantIds[1],
-				relayerKeyId: signingWorkerId,
-				clientShareDerivation: "prf_first_v1"
-			}),
-			timestamp: authority.activatedAtMs
-		};
-	}
-	async resolveExactNearEd25519YaoPreparedMaterial(context, preparation) {
-		const expectedActivation = requireBoundNearEd25519YaoPreparationActivation({
-			context,
-			preparation
-		});
-		switch (preparation.hydration.kind) {
-			case "use_live_runtime": {
-				const capability = this.enginePorts.ed25519YaoActiveClients.resolve({
-					walletId: context.input.walletId,
-					nearAccountId: context.input.nearAccountId,
-					materialActivation: expectedActivation
-				});
-				if (!capability) throw new Error("[SigningEngine][near] active Ed25519 Yao capability is unavailable");
-				return validateExactNearEd25519YaoOperationMaterial({
-					material: capability,
-					input: context.input,
-					expectedActivation
-				});
-			}
-			case "rehydrate_material_activation": {
-				const args = requireAuthorizedNearEd25519BoundaryInput(context.input);
-				switch (args.auth.kind) {
-					case WALLET_AUTH_METHODS.passkey: {
-						const material = await this.rehydrateExactPasskeyEd25519YaoCapabilityForSigning(args);
-						try {
-							const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-							if (authorizationRead.kind !== "found" || authorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.passkey) throw new Error(`[SigningEngine][near] Wallet Session authorization is ${authorizationRead.kind}`);
-							const sealedRuntime = await requireExactEd25519SealedRuntimeForLane({
-								walletId: args.walletId,
-								laneIdentity: args.laneIdentity
-							});
-							await hydrateOwnerNearEd25519ExecutionLane({
-								input: args,
-								authorization: authorizationRead.authorization,
-								sealedRuntime,
-								material
-							});
-							return validateExactNearEd25519YaoOperationMaterial({
-								material,
-								input: args,
-								expectedActivation
-							});
-						} catch (error) {
-							material.activeClient.dispose();
-							throw error;
-						}
-					}
-					case WALLET_AUTH_METHODS.emailOtp: throw new Error("[SigningEngine][near] Email OTP custody cache is unavailable; link the device before signing");
-					default:
-						args.auth;
-						throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-				}
-			}
-			case "reauthorize_public_anchor": throw new Error("[SigningEngine][near] retired material requires reauthorization");
-			case "blocked": throw new Error(`[SigningEngine][near] prepared material is blocked: ${preparation.hydration.reason}`);
-			default:
-				preparation.hydration;
-				throw new Error("[SigningEngine][near] unsupported prepared material hydration");
-		}
-	}
-	async resolveExactNearEd25519YaoWalletSessionState(context) {
-		const args = requireAuthorizedNearEd25519BoundaryInput(context.input);
-		if (args.auth.kind === WALLET_AUTH_METHODS.emailOtp) {
-			if (!context.materialActivation) throw new Error("[SigningEngine][near] prepared material has no activation");
-			const publicLane = await resolveExactEmailOtpPublicLaneReference({
-				store: this.ed25519YaoPublicCapabilityReferences,
-				laneIdentity: args.laneIdentity,
-				materialActivation: context.materialActivation
-			});
-			const material = this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId: args.walletId,
-				nearAccountId: args.nearAccountId,
-				materialActivation: context.materialActivation
-			});
-			if (!material) throw new Error("[SigningEngine][near] active Email OTP Ed25519 material is unavailable");
-			const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-			if (authorizationRead.kind !== "found" || authorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.emailOtp) throw new Error(`[SigningEngine][near] Wallet Session authorization is ${authorizationRead.kind}`);
-			return await emailOtpWalletSessionStateFromPublicLane({
-				reference: publicLane,
-				material: validateExactNearEd25519YaoOperationMaterial({
-					material,
-					input: args,
-					expectedActivation: context.materialActivation
-				}),
-				authorization: authorizationRead.authorization,
-				materialActivation: context.materialActivation,
-				relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-			});
-		}
-		const runtimeResolution = await resolveExactEd25519SealedSessionRuntimeForLane({
-			walletId: args.walletId,
-			laneIdentity: args.laneIdentity
-		});
-		if (runtimeResolution.kind === "missing" && args.auth.kind === WALLET_AUTH_METHODS.passkey) {
-			if (!context.materialActivation) throw new Error("[SigningEngine][near] prepared material has no activation");
-			const publicLane = await resolveExactPasskeyPublicLaneReference({
-				store: this.ed25519YaoPublicCapabilityReferences,
-				laneIdentity: args.laneIdentity
-			});
-			if (!mpcMaterialActivationRefsEqual(publicLane.materialActivation, context.materialActivation)) throw new Error("[SigningEngine][near] Passkey public lane activation changed");
-			const material = this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId: args.walletId,
-				nearAccountId: args.nearAccountId,
-				materialActivation: context.materialActivation
-			});
-			if (!material) throw new Error("[SigningEngine][near] active Passkey Ed25519 material is unavailable");
-			const exactMaterial = validateExactNearEd25519YaoOperationMaterial({
-				material,
-				input: args,
-				expectedActivation: context.materialActivation
-			});
-			const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(args.walletId);
-			if (authorizationRead.kind !== "found" || authorizationRead.authorization.selectedAuthMethod.kind !== WALLET_AUTH_METHODS.passkey) throw new Error(`[SigningEngine][near] Wallet Session authorization is ${authorizationRead.kind}`);
-			return await passkeyWalletSessionStateFromPublicLane({
-				reference: publicLane,
-				material: exactMaterial,
-				authorization: authorizationRead.authorization,
-				materialActivation: context.materialActivation,
-				relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-			});
-		}
-		if (runtimeResolution.kind !== "resolved") throw new Error(`[SigningEngine][near] exact persisted Ed25519 runtime is ${runtimeResolution.kind}`);
-		const runtime = runtimeResolution.runtime;
-		return await walletSessionStateFromExactEd25519Runtime({
-			runtime,
-			relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-		});
-	}
-	async resolveExactNearEd25519FundingSession(context) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(context.input);
-		const authorizationRead = await this.readExactNearEd25519WalletSessionAuthorization(identity.signer.account.wallet.walletId);
-		if (authorizationRead.kind !== "found" || authorizationRead.authorization.selectedAuthMethod.kind !== identity.auth.kind) throw new Error("[SigningEngine][near] authenticated funding session is unavailable");
-		if (!context.materialActivation) throw new Error("[SigningEngine][near] funding session material activation is unavailable");
-		if (!nearEd25519SessionMatchesMaterialActivation({
-			session: authorizationRead.authorization.session,
-			materialActivation: context.materialActivation
-		})) throw new Error("[SigningEngine][near] authenticated funding session material changed");
-		const walletSessionToken = authorizationRead.authorization.operationCredential.token;
-		if (authorizationRead.authorization.session.walletId !== identity.signer.account.wallet.walletId || authorizationRead.authorization.selectedAuthMethod.kind !== identity.auth.kind || !authorizationRead.authorization.operationCredential.walletSessionId || !authorizationRead.authorization.session.quotaId) throw new Error("[SigningEngine][near] funding session identity does not match");
-		return {
-			kind: "near_ed25519_funding_session",
-			signer: identity.signer,
-			thresholdSessionId: identity.thresholdSessionId,
-			walletSessionToken
-		};
-	}
-	async prepareExactNearEd25519YaoOperationStepUpAtBoundary(context, preparation) {
-		if (nearEd25519PresentedAuthFromBoundaryInput(context.input).kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] Email OTP material cannot use Passkey rehydration");
-		const expectedActivation = requireBoundNearEd25519YaoPreparationActivation({
-			context,
-			preparation
-		});
-		const prepared = await this.prepareExactPasskeyEd25519YaoOperationStepUpForSigning(context.input);
-		if (!mpcMaterialActivationRefsEqual(expectedActivation, prepared.materialActivation)) throw new Error("[SigningEngine][near] operation step-up changed material activation");
-		return prepared;
-	}
-	async prepareExactNearEmailOtpEd25519YaoOperationStepUpAtBoundary(context, preparation) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(context.input);
-		if (identity.auth.kind !== WALLET_AUTH_METHODS.emailOtp) throw new Error("[SigningEngine][near] Passkey material cannot use Email OTP rehydration");
-		const expectedActivation = requireBoundNearEd25519YaoPreparationActivation({
-			context,
-			preparation
-		});
-		switch (preparation.hydration.kind) {
-			case "use_live_runtime": return {
-				kind: "live",
-				materialActivation: expectedActivation,
-				material: await this.resolveExactNearEd25519YaoPreparedMaterial(context, preparation)
-			};
-			case "rehydrate_material_activation": {
-				const publicLane = await resolveExactEmailOtpPublicLaneReference({
-					store: this.ed25519YaoPublicCapabilityReferences,
-					laneIdentity: identity,
-					materialActivation: expectedActivation
-				});
-				const user = await this.getUserBySignerSlot(context.input.nearAccountId, identity.signer.signerSlot);
-				if (!user || String(user.walletId) !== String(context.input.walletId) || String(user.nearAccountId) !== String(context.input.nearAccountId) || user.signerSlot !== identity.signer.signerSlot || user.authMethod !== WALLET_AUTH_METHODS.emailOtp) throw new Error("[SigningEngine][near] Email OTP signer record is unavailable");
-				const sealed = await this.loadEmailOtpWalletCustodyEd25519Material({
-					nearAccountId: String(context.input.nearAccountId),
-					signerSlot: user.signerSlot
-				});
-				if (sealed.kind !== "found") throw new Error("[SigningEngine][near] Email OTP custody material is unavailable");
-				if (`ed25519:${base58Encode(base64UrlDecode(sealed.material.binding.registeredPublicKeyB64u))}` !== user.operationalPublicKey || sealed.material.binding.walletId !== String(context.input.walletId) || sealed.material.binding.nearAccountId !== String(context.input.nearAccountId) || sealed.material.binding.signerSlot !== user.signerSlot || sealed.material.binding.signingWorkerId !== String(expectedActivation.signingWorker)) throw new Error("[SigningEngine][near] Email OTP custody material binding changed");
-				const relayerUrl = this.seamsWebConfigs.network.relayer?.url || "";
-				if (!relayerUrl) throw new Error("[SigningEngine][near] Email OTP recovery requires a relay URL");
-				const recoveryContext = {
-					input: context.input,
-					materialActivation: expectedActivation,
-					facts: emailOtpEd25519OperationMaterialFacts({
-						input: context.input,
-						publicLane,
-						relayerUrl
-					}),
-					publicLane,
-					sealedMaterial: sealed.material,
-					operationalPublicKey: user.operationalPublicKey,
-					emailHashHex: await sha256HexUtf8(user.loginDisplayName.trim().toLowerCase())
-				};
-				return {
-					kind: "sealed",
-					materialActivation: expectedActivation,
-					facts: recoveryContext.facts,
-					authorizeAndRehydrate: this.authorizeAndRehydrateEmailOtpEd25519OperationMaterial.bind(this, recoveryContext)
-				};
-			}
-			case "reauthorize_public_anchor": throw new Error("[SigningEngine][near] retired Email OTP material cannot sign");
-			case "blocked": throw new Error(`[SigningEngine][near] Email OTP operation material is blocked: ${preparation.hydration.reason}`);
-			default:
-				preparation.hydration;
-				throw new Error("[SigningEngine][near] unsupported Email OTP operation material");
-		}
-	}
-	async authorizeAndRehydrateEmailOtpEd25519OperationMaterial(context, request) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(context.input);
-		if (identity.auth.kind !== WALLET_AUTH_METHODS.emailOtp || request.proof.providerSubjectId !== identity.auth.providerSubjectId) throw new Error("[SigningEngine][near] Email OTP operation authority changed");
-		const operationCredential = await resolveExactNearEd25519WalletSessionOperationCredentialForStepUp({
-			walletId: context.input.walletId,
-			proof: request.proof
-		});
-		const operationSubject = {
-			kind: "exact_ed25519_export_material",
-			signer: identity.signer,
-			auth: identity.auth,
-			thresholdSessionId: identity.thresholdSessionId
-		};
-		const bootstrap = await resolveEmailOtpEd25519OperationRecoveryBootstrapV1({
-			subject: operationSubject,
-			expectedMaterialActivation: context.materialActivation,
-			authorization: await this.readExactEmailOtpEd25519ExportAuthorization({
-				subject: operationSubject,
-				expectedMaterialActivation: context.materialActivation
-			}),
-			source: {
-				signingWorkerId: context.sealedMaterial.binding.signingWorkerId,
-				participantIds: context.sealedMaterial.binding.participantIds,
-				registeredPublicKeyB64u: context.sealedMaterial.binding.registeredPublicKeyB64u
-			},
-			relayerUrl: context.facts.relayerUrl,
-			fetch: globalThis.fetch.bind(globalThis)
-		});
-		const recovered = await requestRehydrateEmailOtpEd25519YaoOperationMaterial({
-			workerCtx: this.signerWorkerManager.getContext(),
-			payload: {
-				relayUrl: context.facts.relayerUrl,
-				walletId: String(context.input.walletId),
-				orgId: context.publicLane.runtimePolicyScope.orgId,
-				providerSubjectId: identity.auth.providerSubjectId,
-				nearAccountId: String(context.input.nearAccountId),
-				signerSlot: context.publicLane.signerSlot,
-				expectedOperationalPublicKey: context.operationalPublicKey,
-				expectedThresholdSessionId: context.publicLane.thresholdSessionId,
-				expectedMaterialActivation: context.materialActivation,
-				ed25519YaoRecovery: {
-					kind: ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1,
-					signerSlot: context.publicLane.signerSlot,
-					remainingUses: DEFAULT_UNLOCK_REMAINING_USES,
-					orgId: context.publicLane.runtimePolicyScope.orgId
-				},
-				walletCustodyEd25519Material: {
-					kind: "found",
-					material: context.sealedMaterial
-				},
-				bootstrap,
-				normalSigningRequest: request.normalSigningRequest,
-				displayDigest: request.displayDigest,
-				proof: request.proof,
-				operationCredential
-			}
-		});
-		if (recovered.walletCustodyEd25519Material) try {
-			await this.persistWalletCustodyEd25519Material(recovered.walletCustodyEd25519Material);
-		} catch (error) {
-			await disposeWalletCustodyEd25519ActiveClientV1({
-				workerContext: this.signerWorkerManager.getContext(),
-				activeClientHandle: recovered.activeClientHandle
-			}).catch(() => void 0);
-			throw error;
-		}
-		const activeClient = new WalletCustodyEd25519ActiveClientV1(this.signerWorkerManager.getContext(), recovered.activeClientHandle, recovered.metadata);
-		let material;
-		try {
-			material = validateExactNearEd25519YaoOperationMaterial({
-				material: {
-					activeClient,
-					facts: context.facts
-				},
-				input: context.input,
-				expectedActivation: context.materialActivation
-			});
-		} catch (error) {
-			activeClient.dispose();
-			throw error;
-		}
-		return {
-			material,
-			issuedAuthorization: {
-				kind: recovered.issuedAuthorization.kind,
-				authorization: recovered.issuedAuthorization.authorization,
-				expiresAtMs: recovered.issuedAuthorization.expiresAtMs
-			}
-		};
-	}
-	async resolveExactNearEd25519YaoSigningHydration(input) {
-		const args = requireAuthorizedNearEd25519BoundaryInput(input.args);
-		switch (args.auth.kind) {
-			case WALLET_AUTH_METHODS.passkey: {
-				const resolved = await this.resolvePasskeyEd25519YaoHydration({
-					walletSessionState: input.walletSessionState,
-					credentialIdB64u: args.auth.credentialIdB64u,
-					publicLocator: input.publicLocator,
-					unlockSource: input.unlockSource
-				});
-				let hydration;
-				switch (resolved.kind) {
-					case "live":
-					case "blocked":
-						hydration = resolved.plan;
-						break;
-					case "rehydrated":
-						resolved.activeClient.dispose();
-						hydration = resolved.plan;
-						break;
-					default: throw new Error("[SigningEngine][near] unsupported Passkey hydration result");
-				}
-				if (hydration.kind === "blocked" && hydration.reason === "missing_material") return (await preparePasskeyEd25519YaoLocalMaterialRehydrationV1({
-					store: IndexedDBManager,
-					identity: ed25519YaoLocalMaterialIdentityFromWalletSession(input.walletSessionState, args.auth.rpId, args.auth.credentialIdB64u),
-					authority: input.walletSessionState.authority,
-					publicLocator: input.publicLocator
-				})).plan;
-				return hydration;
-			}
-			case WALLET_AUTH_METHODS.emailOtp:
-				if (input.publicLocator.kind !== "available") throw new Error("[SigningEngine][near] Email OTP custody locator is unavailable");
-				return await this.resolveWalletCustodyEmailOtpHydration({
-					walletId: args.walletId,
-					nearAccountId: args.nearAccountId,
-					identity: requireEmailOtpNearEd25519MaterialIdentity(nearEd25519MaterialIdentityFromBoundaryInput(args)),
-					signerSlot: args.laneIdentity.signer.signerSlot,
-					materialActivation: input.publicLocator.materialActivation
-				});
-			default:
-				args.auth;
-				throw new Error("[SigningEngine][near] unsupported Ed25519 material authority");
-		}
-	}
-	async prepareExactPasskeyEd25519YaoOperationStepUpForSigning(args) {
-		const identity = nearEd25519MaterialIdentityFromBoundaryInput(args);
-		if (identity.auth.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][near] Passkey operation step-up requires Passkey material");
-		if (!await this.resolveNearEd25519YaoSigningLane({ ...args.laneIdentity !== void 0 ? {
-			kind: "exact_lane",
-			laneIdentity: args.laneIdentity
-		} : {
-			kind: "material_identity",
-			materialIdentity: identity
-		} })) throw new Error("[SigningEngine][near] sealed Ed25519 operation lane is unavailable");
-		const material = await preparePasskeyEd25519OperationMaterial({
-			walletId: args.walletId,
-			identity,
-			relayerUrl: this.seamsWebConfigs.network.relayer.url
-		});
-		return {
-			materialActivation: material.prepared.plan.materialActivation,
-			facts: material.facts,
-			participantIds: [...material.participantIds],
-			rehydrate: this.rehydratePreparedPasskeyEd25519YaoOperationStepUp.bind(this, {
-				input: args,
-				identity: material.localIdentity,
-				facts: material.facts,
-				authority: material.authority,
-				rpId: identity.auth.rpId,
-				credentialIdB64u: identity.auth.credentialIdB64u,
-				publicLocator: material.publicLocator,
-				materialActivation: material.prepared.plan.materialActivation
-			})
-		};
-	}
-	async rehydratePreparedPasskeyEd25519YaoOperationStepUp(prepared, credential) {
-		if (String(credential.rawId || credential.id || "").trim() !== prepared.credentialIdB64u) throw invalidWalletSigningMaterial("binding_mismatch");
-		const secretSource = buildThresholdEd25519WebAuthnPrfSecretSource({
-			credential,
-			rpId: prepared.rpId
-		});
-		const hydrated = await hydrateExactPasskeyEd25519YaoLocalMaterial({
-			store: IndexedDBManager,
-			identity: prepared.identity,
-			authority: prepared.authority,
-			publicLocator: prepared.publicLocator,
-			unlockSource: {
-				kind: "available",
-				passkeyPrfFirstB64u: secretSource.secretSource.prfFirstB64u
-			},
-			liveMaterial: null
-		});
-		if (hydrated.kind === "blocked") throw walletSigningMaterialBlockError(hydrated.plan.reason);
-		if (hydrated.kind !== "rehydrated") throw invalidWalletSigningMaterial("corrupt");
-		if (!mpcMaterialActivationRefsEqual(prepared.materialActivation, hydrated.plan.materialActivation)) {
-			hydrated.activeClient.dispose();
-			throw invalidWalletSigningMaterial("binding_mismatch");
-		}
-		const material = {
-			activeClient: hydrated.activeClient,
-			facts: prepared.facts
-		};
-		try {
-			return validateExactNearEd25519YaoOperationMaterial({
-				material,
-				input: prepared.input,
-				expectedActivation: prepared.materialActivation
-			});
-		} catch {
-			material.activeClient.dispose();
-			throw invalidWalletSigningMaterial("binding_mismatch");
-		}
-	}
-	async resolveExactPasskeyEd25519YaoExportContext(args) {
-		const relayerUrl = String(this.seamsWebConfigs.network.relayer?.url || "").trim();
-		if (!relayerUrl) throw new Error("[SigningEngine][ed25519-export] passkey export requires relayerUrl");
-		const walletId = toWalletId(String(args.laneIdentity.signer.account.wallet.walletId));
-		if (!await readExactEd25519SealedSession(ed25519DurableMaterialLocator({
-			authMethod: args.laneIdentity.auth.kind,
-			materialActivation: args.materialActivation
-		}))) return await this.resolveLinkedPasskeyEd25519YaoExportContext({
-			...args,
-			walletId,
-			relayerUrl
-		});
-		const runtime = await requireExactEd25519SealedRuntimeForMaterialActivation({
-			walletId,
-			laneIdentity: args.laneIdentity,
-			materialActivation: args.materialActivation
-		});
-		let thresholdSessionId = args.laneIdentity.thresholdSessionId;
-		if (await resolveActiveEd25519WalletSessionAuthorization(runtime.walletId, relayerUrl)) {
-			const walletSessionState = await walletSessionStateFromExactEd25519Runtime({
-				runtime,
-				relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-			});
-			if ((await this.ensurePasskeyEd25519WarmSessionForSigning({
-				runtime,
-				walletSessionState,
-				materialActivation: args.materialActivation
-			})).ok) thresholdSessionId = walletSessionState.thresholdSessionId;
-		}
-		return await resolvePasskeyEd25519YaoExportContextV1({
-			subject: {
-				kind: "owner_sealed_runtime",
-				walletId: toWalletId(String(args.laneIdentity.signer.account.wallet.walletId)),
-				nearAccountId: String(args.laneIdentity.signer.account.nearAccountId),
-				nearEd25519SigningKeyId: String(args.laneIdentity.signer.nearEd25519SigningKeyId),
-				signerSlot: args.laneIdentity.signer.signerSlot,
-				thresholdSessionId,
-				materialActivation: args.materialActivation
-			},
-			relayerUrl,
-			fetch: fetchWithGlobalThis
-		}, {
-			readExactEd25519SealedSession,
-			readPasskeyCustodySessionEnvelope,
-			resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
-			readExactWalletSessionAuthorization: walletSessionAuthorizations.readExactActiveForWallet.bind(walletSessionAuthorizations),
-			resolveExactPasskeyWalletAuthAuthorityRef: resolveBrowserExactPasskeyWalletAuthAuthorityRef,
-			nowMs: this.runtimePorts.clock.nowMs
-		});
-	}
-	async resolveLinkedPasskeyEd25519YaoExportContext(args) {
-		if (args.laneIdentity.auth.kind !== WALLET_AUTH_METHODS.passkey) throw new Error("[SigningEngine][ed25519-export] linked export requires a Passkey lane");
-		const selected = await IndexedDBManager.resolveSelectedWalletAuthority(String(args.walletId));
-		if (selected.kind !== "resolved") {
-			const detail = selected.kind === "integrity_error" ? `: ${selected.reason}` : "";
-			throw new Error(`[SigningEngine][ed25519-export] selected Wallet Authority is ${selected.kind}${detail}`);
-		}
-		const { selection, authMethod, authority, signerMaterials, exportRoot } = selected;
-		if (selection.lockState !== "unlocked" || authMethod.kind !== WALLET_AUTH_METHODS.passkey || authMethod.status !== "active" || authority.state !== "active" || authority.provenance.kind !== "device_link" || String(authMethod.walletId) !== String(args.walletId) || authMethod.walletAuthorityId !== authority.authorityId || authMethod.walletAuthMethodId !== selection.walletAuthMethodId || String(authMethod.rpId) !== String(args.laneIdentity.auth.rpId) || authMethod.credentialIdB64u !== args.laneIdentity.auth.credentialIdB64u) throw new Error("[SigningEngine][ed25519-export] selected linked Passkey authority is unavailable");
-		const authorityActivation = authority.signerActivations.ed25519;
-		if (!authority.permissions.includes("export_keys") || !authorityActivation || !mpcMaterialActivationRefsEqual(authorityActivation.materialActivation, args.materialActivation) || !exportRoot) throw new Error("[SigningEngine][ed25519-export] selected authority has no exact Ed25519 export capability");
-		let linkedMaterial = null;
-		for (const candidate of signerMaterials) {
-			if (!isLinkedEd25519SignerMaterial(candidate) || candidate.authorityId !== authority.authorityId || candidate.walletAuthMethodId !== authMethod.walletAuthMethodId || !mpcMaterialActivationRefsEqual(candidate.materialActivation, args.materialActivation)) continue;
-			if (linkedMaterial) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 material is ambiguous");
-			linkedMaterial = candidate;
-		}
-		if (!linkedMaterial) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 material is unavailable");
-		const targetFactor = linkedMaterial.targetFactor;
-		if (targetFactor.kind !== WALLET_AUTH_METHODS.passkey || targetFactor.walletAuthMethodId !== authMethod.walletAuthMethodId || targetFactor.rpId !== authMethod.rpId || targetFactor.credentialIdB64u !== authMethod.credentialIdB64u) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 factor binding changed");
-		const exactSession = exactWalletSessionWithOperationCredentialOrThrow(await walletSessionAuthorizations.readExactWithOperationCredential({
-			walletId: args.walletId,
-			authorityId: authority.authorityId,
-			authMethodId: authMethod.walletAuthMethodId
-		}), "[SigningEngine][ed25519-export] exact linked Wallet Session requires a newer client");
-		let exactExportSubject = false;
-		if (exactSession) {
-			for (const subject of exactSession.record.capabilitySubjects) if (subject.kind === "export_keys" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)) {
-				exactExportSubject = true;
-				break;
-			}
-		}
-		if (!exactSession || !exactExportSubject || exactSession.record.authorityDigestB64u !== authority.authorityDigestB64u || exactSession.record.authorityRevocationEpoch !== authority.revocationEpoch || exactSession.record.expiresAtMs <= Date.now()) throw new Error("[SigningEngine][ed25519-export] exact linked Wallet Session is unavailable");
-		const publicLane = await resolveExactPasskeyPublicLaneReference({
-			store: this.ed25519YaoPublicCapabilityReferences,
-			laneIdentity: args.laneIdentity
-		});
-		if (!mpcMaterialActivationRefsEqual(publicLane.materialActivation, args.materialActivation)) throw new Error("[SigningEngine][ed25519-export] linked public lane activation changed");
-		const factorAuthority = await walletAuthAuthorityRef({ authority: {
-			walletId: authMethod.walletId,
-			factor: {
-				kind: WALLET_AUTH_METHODS.passkey,
-				credentialIdB64u: authMethod.credentialIdB64u
-			},
-			verifier: {
-				kind: "webauthn",
-				rpId: authMethod.rpId
-			},
-			bindingId: authMethod.walletAuthMethodId
-		} });
-		if (factorAuthority.walletAuthMethodId !== authMethod.walletAuthMethodId) throw new Error("[SigningEngine][ed25519-export] Passkey Wallet Session authority changed");
-		const activeMaterial = this.enginePorts.ed25519YaoActiveClients.resolve({
-			walletId: args.walletId,
-			nearAccountId: args.laneIdentity.signer.account.nearAccountId,
-			materialActivation: args.materialActivation
-		});
-		if (!activeMaterial || activeMaterial.activeClient.status().kind !== "active") throw new Error("[SigningEngine][ed25519-export] linked Ed25519 runtime is unavailable");
-		const metadata = activeMaterial.activeClient.metadata();
-		const metadataActivation = nearEd25519YaoMaterialActivationFromMetadata(metadata);
-		const facts = activeMaterial.facts;
-		const signer = args.laneIdentity.signer;
-		const application = linkedMaterial.publicFacts.applicationBinding;
-		const registeredPublicKeyB64u = base64UrlEncode(metadata.registeredPublicKey);
-		const stateEpoch = Number(metadata.stateEpoch);
-		const parsedThresholdSessionId = parseThresholdEd25519SessionId(metadata.scope.threshold_session_id);
-		const runtimeScope = facts.runtimePolicyScope;
-		const laneScope = publicLane.runtimePolicyScope;
-		if (!parsedThresholdSessionId.ok || !Number.isSafeInteger(stateEpoch) || stateEpoch < 1 || !mpcMaterialActivationRefsEqual(metadataActivation, args.materialActivation) || String(facts.thresholdSessionId) !== String(args.laneIdentity.thresholdSessionId) || String(facts.signer.account.wallet.walletId) !== String(args.walletId) || String(facts.signer.account.nearAccountId) !== String(signer.account.nearAccountId) || String(facts.signer.nearEd25519SigningKeyId) !== String(signer.nearEd25519SigningKeyId) || facts.signer.signerSlot !== signer.signerSlot || application.wallet_id !== String(args.walletId) || application.near_ed25519_signing_key_id !== String(signer.nearEd25519SigningKeyId) || application.key_creation_signer_slot !== signer.signerSlot || metadata.applicationBinding.wallet_id !== application.wallet_id || metadata.applicationBinding.near_ed25519_signing_key_id !== application.near_ed25519_signing_key_id || metadata.applicationBinding.signing_root_id !== application.signing_root_id || metadata.applicationBinding.key_creation_signer_slot !== application.key_creation_signer_slot || metadata.scope.lifecycle_id !== linkedMaterial.publicFacts.targetBinding.lifecycle.lifecycle_id || metadata.scope.root_share_epoch !== linkedMaterial.publicFacts.targetBinding.lifecycle.root_share_epoch || metadata.scope.account_id !== String(args.walletId) || metadata.scope.threshold_session_id !== String(args.laneIdentity.thresholdSessionId) || metadata.scope.signing_worker_id !== facts.routerAbNormalSigning.signingWorkerId || facts.signingRootId !== application.signing_root_id || facts.signingRootVersion !== metadata.scope.root_share_epoch || runtimeScope.orgId !== laneScope.orgId || runtimeScope.projectId !== laneScope.projectId || runtimeScope.envId !== laneScope.envId || runtimeScope.signingRootVersion !== laneScope.signingRootVersion || linkedMaterial.publicFacts.participantIds[0] !== metadata.participantIds[0] || linkedMaterial.publicFacts.participantIds[1] !== metadata.participantIds[1] || base64UrlEncode(Uint8Array.from(linkedMaterial.publicFacts.activationReceipt.registered_public_key)) !== registeredPublicKeyB64u || authorityActivation.signer.registeredPublicKeyB64u !== registeredPublicKeyB64u) throw new Error("[SigningEngine][ed25519-export] linked Ed25519 runtime identity changed");
-		const material = {
-			authority: factorAuthority,
-			walletId: signer.account.wallet.walletId,
-			nearAccountId: signer.account.nearAccountId,
-			nearEd25519SigningKeyId: String(signer.nearEd25519SigningKeyId),
-			signerSlot: signer.signerSlot,
-			operationalPublicKey: `ed25519:${base58Encode(metadata.registeredPublicKey)}`,
-			relayerKeyId: metadata.scope.signing_worker_id,
-			credentialIdB64u: authMethod.credentialIdB64u,
-			capability: {
-				materialActivation: metadataActivation,
-				activeCapabilityBinding: [...metadata.activeCapabilityBinding],
-				registeredPublicKey: [...metadata.registeredPublicKey],
-				nearAccountId: signer.account.nearAccountId,
-				applicationBinding: metadata.applicationBinding,
-				participantIds: metadata.participantIds,
-				runtimePolicyScope: facts.runtimePolicyScope,
-				lifecycle: {
-					lifecycleId: metadata.scope.lifecycle_id,
-					rootShareEpoch: metadata.scope.root_share_epoch,
-					accountId: metadata.scope.account_id,
-					thresholdSessionId: parsedThresholdSessionId.value,
-					signerSetId: metadata.scope.signer_set_id,
-					signingWorkerId: metadata.scope.signing_worker_id
-				},
-				stateEpoch
-			}
-		};
-		return {
-			kind: "ready",
-			context: {
-				kind: "passkey_ed25519_yao_export_context_v1",
-				selectedLaneMaterialActivation: args.materialActivation,
-				material,
-				authorization: exactSession,
-				relayerUrl: args.relayerUrl,
-				rpId: authMethod.rpId,
-				walletCustodyEnvelope: exportRoot.envelope
-			}
-		};
-	}
-	readExactEmailOtpEd25519ExportAuthorization(args) {
-		return readExactEmailOtpEd25519ExportAuthorization({
-			subject: args.subject,
-			relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-		});
-	}
-	async activateRecoveredEmailOtpEd25519ExportCapability(lane, request) {
-		const activation = request.activation;
-		await this.activateEmailOtpEd25519CustodyCapabilityWithExactCredential({
-			commitQueue: "acquire",
-			walletSession: {
-				walletId: lane.signer.account.wallet.walletId,
-				walletSessionUserId: String(lane.signer.account.wallet.walletId)
-			},
-			providerSubject: lane.auth.providerSubjectId,
-			emailHashHex: activation.emailHashHex,
-			signerSlot: lane.signer.signerSlot,
-			expectedOperationalPublicKey: `ed25519:${base58Encode(activation.metadata.registeredPublicKey)}`,
-			expectedThresholdSessionId: String(lane.thresholdSessionId),
-			bootstrap: activation.bootstrap,
-			activeClientHandle: activation.activeClientHandle,
-			metadata: activation.metadata,
-			credentialExpectation: {
-				kind: "expect_exact_operation_credential",
-				operationCredential: request.operationCredential
-			}
-		});
-	}
-	async resolveEmailOtpEd25519YaoExportContext(args) {
-		return await resolveWalletCustodyEd25519ExportContextV1({
-			subject: args.laneIdentity,
-			expectedMaterialActivation: args.materialActivation,
-			readExactWalletSessionAuthorization: this.readExactEmailOtpEd25519ExportAuthorization.bind(this),
-			resolveActiveCapability: (walletId, nearAccountId, materialActivation) => this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId,
-				nearAccountId: toAccountId(nearAccountId),
-				materialActivation
-			}),
-			resolveEd25519YaoClientRootEnvelope: async ({ subject, capability, selectedMaterialActivation }) => resolveSelectedEmailOtpEd25519ExportRootV1({
-				selected: await IndexedDBManager.resolveSelectedWalletAuthority(String(subject.signer.account.wallet.walletId)),
-				subject,
-				expectedMaterialActivation: selectedMaterialActivation,
-				activeCapability: capability
-			}),
-			loadWalletCustodyMaterial: () => this.loadEmailOtpWalletCustodyEd25519Material({
-				nearAccountId: String(args.laneIdentity.signer.account.nearAccountId),
-				signerSlot: args.laneIdentity.signer.signerSlot
-			}),
-			relayerUrl: this.seamsWebConfigs.network.relayer?.url || "",
-			fetch: fetchWithGlobalThis,
-			activateRecoveredCapability: this.activateRecoveredEmailOtpEd25519ExportCapability.bind(this, args.laneIdentity)
-		});
-	}
-	async resolveActiveNearEd25519YaoSigningLane(subject) {
-		if (!await this.resolveNearEd25519YaoSigningLane(subject)) return null;
-		const identity = nearEd25519CapabilityRehydrationMaterialIdentity(subject);
-		const capability = subject.kind === "export_exact_lane" ? this.enginePorts.ed25519YaoActiveClients.resolve({
-			walletId: identity.signer.account.wallet.walletId,
-			nearAccountId: identity.signer.account.nearAccountId,
-			materialActivation: subject.materialActivation
-		}) : this.enginePorts.ed25519YaoActiveClients.resolveForWalletAccount({
-			walletId: identity.signer.account.wallet.walletId,
-			nearAccountId: identity.signer.account.nearAccountId
-		});
-		return capability?.activeClient.status().kind === "active" ? capability : null;
-	}
-	async resolveNearEd25519YaoSigningLane(subject) {
-		const walletId = nearEd25519CapabilityRehydrationMaterialIdentity(subject).signer.account.wallet.walletId;
-		const availableLanes = await this.readPersistedAvailableSigningLanes({
-			walletId,
-			ownerScope: await this.resolveSelectedOwnerLaneScope(walletId)
-		});
-		const matches = [];
-		for (const lane of availableLanes.candidates.ed25519.near) {
-			if (!nearEd25519LaneMatchesCapabilityRehydrationSubject(lane, subject)) continue;
-			if (!isConcreteAvailableSigningLane(lane) || lane.curve !== "ed25519") continue;
-			matches.push(lane);
-		}
-		if (matches.length > 1) throw new Error("[SigningEngine][near] local Ed25519 material lane is ambiguous");
-		return matches[0] || null;
-	}
-	async ensurePasskeyEd25519WarmSessionForSigning(args) {
-		const claim = await ensurePasskeyEd25519WarmSessionForSigning({
-			...args,
-			claimWarmSessionMaterial: this.passkeyMpcSession.claimWarmSessionMaterial.bind(this.passkeyMpcSession),
-			rehydrateWarmSessionMaterial: this.passkeyMpcSession.rehydrateWarmSessionMaterial.bind(this.passkeyMpcSession)
-		});
-		if (claim.ok && args.runtime.factor.kind === "passkey" && String(args.runtime.thresholdSessionId) !== String(args.walletSessionState.thresholdSessionId)) await persistPasskeyEd25519YaoSessionForRefresh({
-			persistence: this,
-			session: args.walletSessionState,
-			prfFirstB64u: claim.prfFirstB64u,
-			ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-				rpId: args.runtime.factor.rpId,
-				nearAccountId: args.runtime.nearAccountId,
-				nearEd25519SigningKeyId: args.runtime.nearEd25519SigningKeyId,
-				relayerKeyId: args.runtime.relayerKeyId,
-				participantIds: args.runtime.participantIds,
-				runtimePolicyScope: args.runtime.runtimePolicyScope,
-				signerSlot: args.runtime.signerSlot,
-				routerAbNormalSigning: args.runtime.routerAbNormalSigning,
-				credentialIdB64u: args.runtime.factor.credentialIdB64u,
-				materialActivation: args.materialActivation
-			}),
-			materialActivation: args.materialActivation
-		});
-		return claim;
-	}
-	async rehydrateNearEd25519YaoCapabilityForSigning(subject) {
-		const identity = nearEd25519CapabilityRehydrationMaterialIdentity(subject);
-		const lane = await this.resolveNearEd25519YaoSigningLane(subject);
-		if (!lane) throw new Error("[SigningEngine][near] local Ed25519 material lane is unavailable");
-		let runtime;
-		if (subject.kind === "export_exact_lane") runtime = await requireExactEd25519SealedRuntimeForMaterialActivation({
-			walletId: identity.signer.account.wallet.walletId,
-			laneIdentity: subject.laneIdentity,
-			materialActivation: subject.materialActivation
-		});
-		else {
-			const laneIdentity = subject.kind === "exact_lane" ? subject.laneIdentity : exactEd25519LaneIdentityFromAvailableLane(lane);
-			runtime = await requireExactEd25519SealedRuntimeForLane({
-				walletId: identity.signer.account.wallet.walletId,
-				laneIdentity
-			});
-		}
-		const walletSessionState = await walletSessionStateFromExactEd25519Runtime({
-			runtime,
-			relayerUrl: String(this.seamsWebConfigs.network.relayer?.url || "").trim()
-		});
-		if (runtime.factor.kind !== "passkey") throw new Error("[SigningEngine][near] persisted Ed25519 credential is unavailable");
-		const credentialIdB64u = runtime.factor.credentialIdB64u;
-		const materialActivation = runtime.sealedRecord.ed25519Restore.materialActivation;
-		if (!mpcMaterialActivationRefsEqual(materialActivation, lane.materialActivation)) throw new Error("[SigningEngine][near] persisted Ed25519 material activation mismatch");
-		const warmSessionClaim = await this.ensurePasskeyEd25519WarmSessionForSigning({
-			runtime,
-			walletSessionState,
-			materialActivation
-		});
-		const publicLocator = {
-			kind: "available",
-			walletId: String(walletSessionState.signingLane.identity.signer.account.wallet.walletId),
-			nearAccountId: String(walletSessionState.signingLane.identity.signer.account.nearAccountId),
-			signerSlot: walletSessionState.signingLane.identity.signer.signerSlot,
-			materialActivation
-		};
-		const liveHydration = await this.resolvePasskeyEd25519YaoHydration({
-			walletSessionState,
-			credentialIdB64u,
-			publicLocator,
-			unlockSource: warmSessionClaim.ok ? {
-				kind: "available",
-				passkeyPrfFirstB64u: warmSessionClaim.prfFirstB64u
-			} : { kind: "unavailable" }
-		});
-		if (liveHydration.kind === "live") {
-			const material = await this.resolveActiveNearEd25519YaoSigningLane(subject);
-			if (!material) throw new Error("[SigningEngine][near] local material rehydration did not publish a lane");
-			return {
-				subject,
-				material
-			};
-		}
-		if (liveHydration.kind === "rehydrated") {
-			if (!warmSessionClaim.ok) {
-				liveHydration.activeClient.dispose();
-				throw new Error("[SigningEngine][near] local material rehydration lost the PRF secret");
-			}
-			try {
-				await persistPasskeyEd25519YaoSessionForRefresh({
-					persistence: this,
-					session: walletSessionState,
-					prfFirstB64u: warmSessionClaim.prfFirstB64u,
-					ed25519Restore: buildPasskeyEd25519RestoreMetadata({
-						rpId: runtime.factor.rpId,
-						nearAccountId: runtime.nearAccountId,
-						nearEd25519SigningKeyId: runtime.nearEd25519SigningKeyId,
-						relayerKeyId: runtime.relayerKeyId,
-						participantIds: runtime.participantIds,
-						runtimePolicyScope: runtime.runtimePolicyScope,
-						signerSlot: runtime.signerSlot,
-						routerAbNormalSigning: runtime.routerAbNormalSigning,
-						credentialIdB64u,
-						materialActivation
-					}),
-					materialActivation
-				});
-				await this.enginePorts.ed25519YaoActiveClients.activate({
-					activeClient: liveHydration.activeClient,
-					facts: nearEd25519YaoOperationMaterialFacts(walletSessionState)
-				});
-				const reboundSubject = currentNearEd25519CapabilityRehydrationSubject({
-					subject,
-					walletSessionState
-				});
-				const published = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
-				if (!published) throw new Error("[SigningEngine][near] local material rehydration did not publish an active lane");
-				return {
-					subject: reboundSubject,
-					material: published
-				};
-			} catch (error) {
-				liveHydration.activeClient.dispose();
-				throw error;
-			}
-		}
-		if (liveHydration.plan.reason !== "missing_material") throw new Error(`[SigningEngine][near] local threshold Ed25519 hydration blocked: ${liveHydration.plan.reason}`);
-		throw new Error("[SigningEngine][near] local threshold Ed25519 material requires Passkey reauthorization");
-	}
-	async resolvePasskeyEd25519YaoHydration(args) {
-		const signer = args.walletSessionState.signingLane.identity.signer;
-		return hydratePasskeyEd25519YaoLocalMaterialV1({
-			store: IndexedDBManager,
-			identity: ed25519YaoLocalMaterialIdentityFromWalletSession(args.walletSessionState, this.getRpId(), args.credentialIdB64u),
-			authority: args.walletSessionState.authority,
-			publicLocator: args.publicLocator,
-			unlockSource: args.unlockSource,
-			liveMaterial: args.publicLocator.kind === "available" ? this.enginePorts.ed25519YaoActiveClients.resolve({
-				walletId: signer.account.wallet.walletId,
-				nearAccountId: signer.account.nearAccountId,
-				materialActivation: args.publicLocator.materialActivation
-			}) : null
-		});
-	}
-	async signEvmFamily(args) {
-		return await signEvmFamily(this.enginePorts.tempoSigningDeps, args);
-	}
-	async reportTempoBroadcastAccepted(args) {
-		await reportTempoBroadcastAccepted(this.enginePorts.tempoSigningDeps, args);
-	}
-	async reportTempoBroadcastRejected(args) {
-		await reportTempoBroadcastRejected(this.enginePorts.tempoSigningDeps, args);
-	}
-	async reportTempoFinalized(args) {
-		await reportTempoFinalized(this.enginePorts.tempoSigningDeps, args);
-	}
-	async reportTempoDroppedOrReplaced(args) {
-		await reportTempoDroppedOrReplaced(this.enginePorts.tempoSigningDeps, args);
-	}
-	async reconcileTempoNonceLane(args) {
-		return await reconcileTempoNonceLane(this.enginePorts.tempoSigningDeps, args);
-	}
-	storeUserData(userData) {
-		return storeUserData(this.registrationPublicDeps, userData);
-	}
-	async storeNearThresholdKeyMaterial(input) {
-		await storeNearThresholdKeyMaterial({
-			clientDB: IndexedDBManager,
-			keyMaterialStore: IndexedDBManager
-		}, input);
-	}
-	getAllUsers() {
-		return getAllUsers(this.registrationPublicDeps);
-	}
-	getUserBySignerSlot(nearAccountId, signerSlot) {
-		return getUserBySignerSlot(this.registrationPublicDeps, nearAccountId, signerSlot);
-	}
-	getLastUser() {
-		return getLastUser(this.registrationPublicDeps);
-	}
-	nearAuthenticatorsByAccount(nearAccountId) {
-		return nearAuthenticatorsByAccount(this.registrationPublicDeps, nearAccountId);
-	}
-	setLastUser(walletId, signerSlot) {
-		return setLastUser(this.registrationPublicDeps, walletId, signerSlot);
-	}
-	activateAuthenticatedWalletState(args) {
-		return activateAuthenticatedWalletState(this.registrationPublicDeps, args);
-	}
-	async upsertEd25519YaoPublicCapabilityReference(identity) {
-		await this.ed25519YaoPublicCapabilityReferences.upsert(identity);
-	}
-	async upsertEd25519YaoPublicCapabilityLaneReference(reference) {
-		await publishEd25519YaoPublicCapabilityReferenceAndLane(this.ed25519YaoPublicCapabilityReferences, reference);
-	}
-	setWalletNearProvisioningState(write) {
-		return setWalletNearProvisioningState(this.registrationPublicDeps, write);
-	}
-	getWalletNearProvisioningState(walletId) {
-		return getWalletNearProvisioningState(this.registrationPublicDeps, walletId);
-	}
-	storeAuthenticator(authenticatorData) {
-		return storeAuthenticator(this.registrationPublicDeps, authenticatorData);
-	}
-	rollbackUserRegistration(nearAccountId) {
-		return rollbackUserRegistration(this.registrationPublicDeps, nearAccountId);
-	}
-	hasPasskeyCredential(nearAccountId) {
-		return hasPasskeyCredential(this.registrationPublicDeps, nearAccountId);
-	}
-	storeWalletEd25519RegistrationData(input) {
-		return storeWalletEd25519RegistrationData(this.registrationPublicDeps, input);
-	}
-	storeWalletMixedRegistrationData(input) {
-		return storeWalletMixedRegistrationData(this.registrationPublicDeps, input);
-	}
-	storeWalletEd25519RecoveryRegistrationData(input) {
-		return storeWalletEd25519RecoveryRegistrationData(this.registrationPublicDeps, input);
-	}
-	storeWalletEmailOtpEd25519RegistrationData(input) {
-		return storeWalletEmailOtpEd25519RegistrationData(this.registrationPublicDeps, input);
-	}
-	storeWalletEmailOtpMixedRegistrationData(input) {
-		return storeWalletEmailOtpMixedRegistrationData(this.registrationPublicDeps, input);
-	}
-	finalizeWalletEd25519SignerRegistration(input) {
-		return finalizeWalletEd25519SignerRegistration(this.registrationPublicDeps, input);
-	}
-	rollbackWalletEd25519SignerRegistration(receipt) {
-		return rollbackWalletEd25519SignerRegistration(this.registrationPublicDeps, receipt);
-	}
-	createRouterAbEcdsaRegistrationCeremony(input) {
-		return this.runtimePorts.signerCrypto.createRouterAbEcdsaRegistrationCeremony(input);
-	}
-	verifyRouterAbEcdsaRegistrationClientProofs(input) {
-		return this.runtimePorts.signerCrypto.verifyRouterAbEcdsaRegistrationClientProofs(input);
-	}
-	persistInitialCanonicalEcdsaActivation(input) {
-		return this.runtimePorts.signerCrypto.persistInitialCanonicalEcdsaActivation(input);
-	}
-	finalizeRouterAbEcdsaRegistrationActivation(input) {
-		return this.runtimePorts.signerCrypto.finalizeRouterAbEcdsaRegistrationActivation(input);
-	}
-	closeRouterAbEcdsaRegistrationCeremony(input) {
-		return this.runtimePorts.signerCrypto.closeRouterAbEcdsaRegistrationCeremony(input);
-	}
-	finalizeWalletRegistrationEcdsaSessions(input) {
-		return finalizeWalletRegistrationEcdsaSessions(input);
-	}
-	storeWalletEcdsaSignerRecords(input) {
-		return storeWalletEcdsaSignerRecords(this.registrationPublicDeps, input);
-	}
-	storeWalletEcdsaRecoverySignerRecords(input) {
-		return storeWalletEcdsaRecoverySignerRecords(this.registrationPublicDeps, input);
-	}
-	storeWalletEmailOtpEcdsaSignerRecords(input) {
-		return storeWalletEmailOtpEcdsaSignerRecords(this.registrationPublicDeps, input);
-	}
-	finalizeWalletEcdsaRegistration(input) {
-		return finalizeWalletEcdsaRegistration(this.registrationPublicDeps, input);
-	}
-	async activateVerifiedNearEd25519YaoMaterial(material) {
-		return await this.enginePorts.ed25519YaoActiveClients.activate(material);
-	}
-	async withExactEd25519MaterialOwner(args) {
-		return await withThresholdEd25519CommitQueue({
-			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
-			nearAccountId: args.nearAccountId,
-			enabled: true,
-			task: args.task
-		});
-	}
-	storeWalletEmailOtpEcdsaRegistrationData(input) {
-		return storeWalletEmailOtpEcdsaRegistrationData(this.registrationPublicDeps, input);
-	}
-	prepareSigningSessionHydration(input) {
-		return this.passkeyMpcSession.prepareSigningSessionHydration(input);
-	}
-	readPreparedSigningSessionHydration(input) {
-		return this.passkeyMpcSession.readPreparedSigningSessionHydration(input);
-	}
-	discardSigningSessionHydration(input) {
-		return this.passkeyMpcSession.discardSigningSessionHydration(input);
-	}
-	hydrateSigningSession(input) {
-		return hydrateSigningSession(this.warmCapabilitiesPublicDeps, input);
-	}
-	persistSigningSessionSealForThresholdSession(input) {
-		return this.passkeyMpcSession.persistSigningSessionSealForThresholdSession(input);
-	}
-	/**
-	* Collects the one-time email code inside the wallet.
-	*
-	* Built on the same confirmation channel key export uses, so the code is
-	* typed into the wallet's own surface and never passes through the host
-	* application — the reason `addEmailOtp` takes an address and not a code.
-	*/
-	async requestEmailOtpEnrollmentConfirmation(params) {
-		let currentChallengeId = params.challengeId;
-		const emailOtpPrompt = {
-			challengeId: params.challengeId,
-			...params.emailHint ? { emailHint: params.emailHint } : {},
-			title: params.confirmerText?.title || "Enter email code to add sign-in",
-			body: params.confirmerText?.body || `This one-time code confirms ${params.emailAddress} can unlock this wallet.`,
-			helperText: "Enter the 6-digit code sent to your email",
-			onResend: async () => {
-				const resent = await params.onResend();
-				currentChallengeId = resent.challengeId;
-				return {
-					challengeId: resent.challengeId,
-					...resent.emailHint ? { emailHint: resent.emailHint } : {},
-					delivery: { mode: "email_provider" }
-				};
-			}
-		};
-		const decision = await this.touchConfirm.requestUserConfirmation({
-			requestId: secureRandomId("add-auth-method-email-otp", 32, "Email OTP enrollment UI ids"),
-			type: UserConfirmationType.SIGN_INTENT_DIGEST,
-			summary: {
-				type: "add_auth_method",
-				operation: "Add email code sign-in",
-				title: emailOtpPrompt.title,
-				body: emailOtpPrompt.body,
-				warning: "Security note: Adding email code lowers this wallet’s security because your inbox becomes another way to unlock it."
-			},
-			payload: {
-				signingSubject: {
-					kind: "evm_wallet",
-					walletId: params.walletId
-				},
-				challengeB64u: params.challengeId,
-				signingAuthPlan: {
-					kind: SigningAuthPlanKind.EmailOtpReauth,
-					method: "email_otp",
-					emailOtpPrompt
-				},
-				emailOtpPrompt
-			},
-			intentDigest: `add-auth-method:${params.walletId}:email-otp`,
-			...params.confirmationConfigOverride ? { confirmationConfigOverride: params.confirmationConfigOverride } : {}
-		});
-		if (!decision.confirmed) throw new Error(decision.error || "Adding an email code was cancelled");
-		const otpCode = String(decision.otpCode || "").replace(/\D/g, "").slice(0, 6);
-		if (otpCode.length !== 6) throw new Error("Adding an email code requires a 6-digit code");
-		return {
-			challengeId: String(decision.emailOtpChallengeId || currentChallengeId).trim(),
-			otpCode
-		};
-	}
-	requestRegistrationCredentialConfirmation(params) {
-		return requestRegistrationCredentialConfirmation(this.registrationPublicDeps, params);
-	}
-	openRegistrationPreparationModal(params) {
-		return this.touchConfirm.openRegistrationPreparationModal(params);
-	}
-	closeRegistrationPreparationModal() {
-		this.touchConfirm.closeRegistrationPreparationModal();
-	}
-	startPreparedPasskeyRegistrationCredential(args) {
-		if (this.touchIdPrompt.getRpId() !== args.expectedRpId) throw new Error("Prepared registration rpId does not match the wallet runtime");
-		return this.touchIdPrompt.generateRegistrationCredentialsInternal({
-			kind: "wallet_registration",
-			walletId: args.walletId,
-			challengeB64u: args.challengeB64u,
-			signerSlot: args.signerSlot,
-			intendedUserName: args.walletId,
-			prompt: {
-				kind: "reserved",
-				reservation: args.reservation,
-				owner: args.owner,
-				cancellation: args.cancellation
-			}
-		}).then(serializePreparedRegistrationCredential);
-	}
-	getAuthenticationCredentialsSerialized(args) {
-		if (args.cancellation) return this.touchIdPrompt.getAuthenticationCredentialsSerializedForChallengeB64u(args);
-		return getAuthenticationCredentialsSerialized(this.registrationPublicDeps, args);
-	}
-	async exportKeypairWithUI(input) {
-		return await exportKeypairWithUI(this.recoveryPublicDeps, input);
-	}
-	async resolveExactKeyExportLane(input) {
-		return await resolveExactKeyExportLane(this.recoveryPublicDeps, input);
-	}
-	async connectEd25519Session(args) {
-		return await connectEd25519Session(this.passkeyPublicDeps, args);
-	}
-	async bootstrapEcdsaSession(args) {
-		return await bootstrapEcdsaSession(this.passkeyPublicDeps, args);
-	}
-	async loginWithEmailOtpEcdsaCapabilityInternal(args) {
-		return await loginWithEmailOtpEcdsaCapabilityInternal(this.emailOtpPublicDeps, args);
-	}
-	async resolveEmailOtpEd25519CustodyProjectionInternal(args) {
-		const walletId = String(args.walletSession.walletId);
-		let activation;
-		switch (args.selector.kind) {
-			case "material_activation":
-				activation = args.selector.materialActivation;
-				break;
-			case "wallet_auth_method": {
-				const selected = await IndexedDBManager.resolveWalletAuthorityForMethod(walletId, args.selector.walletAuthMethodId);
-				activation = selected.kind === "resolved" && selected.authority.state === "active" ? selected.authority.signerActivations.ed25519?.materialActivation : void 0;
-				break;
-			}
-			case "selected_wallet_authority": {
-				const selected = await IndexedDBManager.resolveSelectedWalletAuthority(walletId);
-				activation = selected.kind === "resolved" && selected.authority.state === "active" ? selected.authority.signerActivations.ed25519?.materialActivation : void 0;
-				break;
-			}
-			default: args.selector;
-		}
-		if (!activation) return null;
-		return await resolveWalletCustodyEd25519ProjectionV1({
-			listPublicCapabilityReferences: this.ed25519YaoPublicCapabilityReferences.list.bind(this.ed25519YaoPublicCapabilityReferences),
-			listUsers: this.getAllUsers.bind(this)
-		}, args.walletSession, args.providerSubjectId, activation);
-	}
-	/**
-	* What an owner authority needs to have its Ed25519 runtime built inside the
-	* unlock that verifies its factor.
-	*
-	* Assembled here rather than by the caller because every field is read off
-	* the exact authority projection - the identity, its runtime policy scope,
-	* and the custody material cached against that signer. A caller assembling
-	* them independently could pair one authority's identity with another's
-	* material.
-	*/
-	async resolveOwnerAuthorityEd25519UnlockRequestInternal(args) {
-		const projection = await this.resolveEmailOtpEd25519CustodyProjectionInternal({
-			walletSession: args.walletSession,
-			providerSubjectId: args.providerSubjectId,
-			selector: {
-				kind: "wallet_auth_method",
-				walletAuthMethodId: args.walletAuthMethodId
-			}
-		});
-		if (!projection) return null;
-		const signerSlot = projection.user.signerSlot;
-		return {
-			kind: "owner_authority",
-			signerSlot,
-			remainingUses: args.remainingUses,
-			recovery: {
-				ed25519YaoRecovery: {
-					kind: ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1,
-					signerSlot,
-					remainingUses: args.remainingUses,
-					orgId: projection.identity.runtimePolicyScope.orgId
-				},
-				providerSubject: projection.providerSubject,
-				nearAccountId: String(projection.identity.nearAccountId),
-				expectedOperationalPublicKey: projection.user.operationalPublicKey,
-				expectedThresholdSessionId: String(projection.identity.thresholdSessionId),
-				walletCustodyEd25519Material: await this.loadEmailOtpWalletCustodyEd25519Material({
-					nearAccountId: String(projection.identity.nearAccountId),
-					signerSlot
-				})
-			}
-		};
-	}
-	/**
-	* Activate the runtime an owner authority's unlock built.
-	*
-	* The identity it is checked against comes from the same authority projection
-	* that produced the unlock request, not from the bootstrap being checked -
-	* comparing a value against itself proves nothing, and the projection is what
-	* says which signer this authority owns.
-	*/
-	async activateOwnerAuthorityEd25519RuntimeInternal(args) {
-		const projection = await this.resolveEmailOtpEd25519CustodyProjectionInternal({
-			walletSession: args.walletSession,
-			providerSubjectId: args.providerSubjectId,
-			selector: {
-				kind: "wallet_auth_method",
-				walletAuthMethodId: args.walletAuthMethodId
-			}
-		});
-		if (!projection) throw new Error("Owner Email OTP Ed25519 activation has no signer projection");
-		await this.activateEmailOtpEd25519CustodyCapabilityInternal({
-			walletSession: args.walletSession,
-			providerSubject: projection.providerSubject,
-			emailHashHex: args.emailHashHex,
-			signerSlot: projection.user.signerSlot,
-			expectedOperationalPublicKey: projection.user.operationalPublicKey,
-			expectedThresholdSessionId: String(projection.identity.thresholdSessionId),
-			bootstrap: args.bootstrap,
-			activeClientHandle: args.activeClientHandle,
-			metadata: args.metadata,
-			authority: args.authority,
-			commitQueue: "acquire"
-		});
-	}
-	async activateEmailOtpEd25519RegistrationMaterialInternal(args) {
-		const activated = await this.signerWorkerManager.requestWorkerOperation({
-			kind: "emailOtp",
-			request: {
-				type: "activateEmailOtpEd25519YaoRegistrationMaterial",
-				payload: {
-					material: args.material,
-					bootstrap: args.bootstrap,
-					envelope: args.envelope,
-					factorSecret32: args.factorSecret32
-				},
-				transfer: [args.factorSecret32]
-			}
-		});
-		try {
-			const signer = await this.activateEmailOtpEd25519CustodyCapabilityInternal({
-				commitQueue: "acquire",
-				walletSession: args.walletSession,
-				providerSubject: args.providerSubject,
-				emailHashHex: args.emailHashHex,
-				signerSlot: args.signerSlot,
-				expectedOperationalPublicKey: args.expectedOperationalPublicKey,
-				expectedThresholdSessionId: args.expectedThresholdSessionId,
-				bootstrap: args.bootstrap,
-				activeClientHandle: activated.activeClientHandle,
-				metadata: activated.metadata
-			});
-			await resolveExactEmailOtpEd25519ActivationAuthorization({
-				walletId: args.walletSession.walletId,
-				emailHashHex: args.emailHashHex,
-				providerSubject: args.providerSubject,
-				bootstrap: args.bootstrap
-			});
-			return signer;
-		} catch (error) {
-			try {
-				await requestClearEmailOtpWarmSessionMaterial({
-					worker: this.signerWorkerManager.getContext(),
-					target: {
-						kind: "ed25519_yao",
-						thresholdSessionId: args.bootstrap.session.thresholdSessionId,
-						materialActivation: activated.metadata.materialActivation
-					}
-				});
-			} catch {}
-			try {
-				await disposeWalletCustodyEd25519ActiveClientV1({
-					workerContext: this.signerWorkerManager.getContext(),
-					activeClientHandle: activated.activeClientHandle
-				});
-			} catch {}
-			throw error;
-		}
-	}
-	async activateEmailOtpEd25519CustodyCapabilityInternal(args) {
-		return await this.activateEmailOtpEd25519CustodyCapabilityWithExactCredential({
-			...args,
-			credentialExpectation: { kind: "resolve_exact_operation_credential" }
-		});
-	}
-	async activateEmailOtpEd25519CustodyCapabilityWithExactCredential(args) {
-		const exactAuthorization = await resolveExactEmailOtpEd25519ActivationAuthorization({
-			walletId: args.walletSession.walletId,
-			emailHashHex: args.emailHashHex,
-			providerSubject: args.providerSubject,
-			bootstrap: args.bootstrap,
-			...args.authority ? { verifiedAuthority: args.authority } : {},
-			...args.exactAuthorization ? { exactAuthorization: args.exactAuthorization } : {}
-		});
-		if (args.credentialExpectation.kind === "expect_exact_operation_credential" && (args.credentialExpectation.operationCredential.walletSessionId !== exactAuthorization.operationCredential.walletSessionId || args.credentialExpectation.operationCredential.token !== exactAuthorization.operationCredential.token)) throw new Error("[SigningEngine][near] expected Email OTP operation credential changed");
-		return await withThresholdEd25519CommitQueue({
-			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.metadata.materialActivation }),
-			nearAccountId: toAccountId(args.bootstrap.session.nearAccountId),
-			enabled: args.commitQueue === "acquire",
-			task: async () => {
-				const activated = await activateWalletCustodyEd25519CapabilityV1({
-					walletSession: args.walletSession,
-					nearAccountId: args.bootstrap.session.nearAccountId,
-					providerSubject: args.providerSubject,
-					relayerUrl: this.seamsWebConfigs.network.relayer?.url || "",
-					authority: exactAuthorization.authority,
-					signerSlot: args.signerSlot,
-					expectedOperationalPublicKey: args.expectedOperationalPublicKey,
-					expectedThresholdSessionId: args.expectedThresholdSessionId,
-					bootstrap: args.bootstrap,
-					operationCredential: exactAuthorization.operationCredential,
-					activeClientHandle: args.activeClientHandle,
-					metadata: args.metadata,
-					workerContext: this.signerWorkerManager.getContext(),
-					activateCapability: this.enginePorts.ed25519YaoActiveClients.activate.bind(this.enginePorts.ed25519YaoActiveClients)
-				});
-				const state = activated.walletSessionState;
-				await this.upsertEd25519YaoPublicCapabilityLaneReference(emailOtpEd25519YaoLaneReferenceFromRecovery({
-					walletSessionState: state,
-					materialActivation: activated.material.activeClient.metadata().materialActivation
-				}));
-				if (!this.enginePorts.ed25519YaoActiveClients.resolve({
-					walletId: state.signingLane.identity.signer.account.wallet.walletId,
-					nearAccountId: state.signingLane.identity.signer.account.nearAccountId,
-					materialActivation: activated.material.activeClient.metadata().materialActivation
-				})) throw new Error("[SigningEngine][near] wallet custody activation was superseded");
-				return state.signingLane.identity.signer;
-			}
-		});
-	}
-	async loginWithEmailOtpWalletCustodyEd25519Internal(args) {
-		if (args.authoritySelector.kind !== "wallet_auth_method") throw new Error("Email OTP Ed25519 unlock requires an exact wallet auth method");
-		const walletAuthMethodId = args.authoritySelector.walletAuthMethodId;
-		const selection = args.ed25519Selection;
-		const unlock = await unlockEmailOtpEd25519YaoCapability({
-			walletSession: args.walletSession,
-			authoritySelector: args.authoritySelector,
-			relayUrl: this.seamsWebConfigs.network.relayer?.url || "",
-			groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-			verification: {
-				kind: "otp",
-				challengeId: args.challengeId,
-				otpCode: args.otpCode
-			},
-			routePlan: buildFreshEmailOtpRoutePlan({
-				freshRouteFamily: "login",
-				operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-			}),
-			workerCtx: this.signerWorkerManager.getContext(),
-			providerSubject: args.providerSubjectId,
-			signerSlot: selection.signerSlot,
-			remainingUses: args.remainingUses,
-			orgId: selection.runtimePolicyScope.orgId,
-			nearAccountId: selection.nearAccountId,
-			expectedOperationalPublicKey: selection.operationalPublicKey,
-			expectedThresholdSessionId: selection.thresholdSessionId,
-			walletCustodyEd25519Material: await this.loadEmailOtpWalletCustodyEd25519Material({
-				nearAccountId: selection.nearAccountId,
-				signerSlot: selection.signerSlot
-			})
-		});
-		if (unlock.kind === "wallet_custody_cache_absent") throw new Error("Email OTP wallet custody material is unavailable; recover with a recovery code");
-		try {
-			await persistVerifiedEmailOtpAuthorityAfterUnlock({
-				walletId: String(args.walletSession.walletId),
-				walletAuthMethodId,
-				projection: unlock.recovery.verifiedAuthorityProjection
-			});
-			const authority = await walletAuthAuthorityRefForVerifiedEmailOtpUnlock({
-				walletId: String(args.walletSession.walletId),
-				walletAuthMethodId,
-				providerSubject: args.providerSubjectId,
-				emailHashHex: args.emailHashHex,
-				projection: unlock.recovery.verifiedAuthorityProjection
-			});
-			if (unlock.walletCustodyEd25519Material) await this.persistWalletCustodyEd25519Material(unlock.walletCustodyEd25519Material);
-			await walletSessionAuthorizations.replaceExactActive({
-				active: unlock.walletSessionAuthorization.record,
-				operationCredential: unlock.walletSessionAuthorization.operationCredential
-			});
-			const signer = await this.activateEmailOtpEd25519CustodyCapabilityInternal({
-				commitQueue: "acquire",
-				walletSession: args.walletSession,
-				providerSubject: args.providerSubjectId,
-				emailHashHex: args.emailHashHex,
-				signerSlot: selection.signerSlot,
-				expectedOperationalPublicKey: selection.operationalPublicKey,
-				expectedThresholdSessionId: selection.thresholdSessionId,
-				bootstrap: unlock.ed25519YaoCapability,
-				activeClientHandle: unlock.activeClientHandle,
-				metadata: unlock.metadata,
-				authority,
-				exactAuthorization: unlock.walletSessionAuthorization
-			});
-			await establishUnlockedWalletEd25519ExportRootCapabilityV1(this.walletCustodyCeremonyTransportV1(), {
-				existingEnvelope: unlock.ed25519ExportRootCustody.existingEnvelope,
-				existingFactorSecret: unlock.ed25519ExportRootCustody.factorSecret32,
-				walletId: String(args.walletSession.walletId),
-				walletAuthMethodId: String(unlock.walletSessionAuthorization.record.authMethodId),
-				walletSessionId: String(unlock.walletSessionAuthorization.operationCredential.walletSessionId),
-				expiresAtMs: unlock.walletSessionAuthorization.record.expiresAtMs
-			});
-			return signer;
-		} catch (error) {
-			await disposeWalletCustodyEd25519ActiveClientV1({
-				workerContext: this.signerWorkerManager.getContext(),
-				activeClientHandle: unlock.activeClientHandle
-			}).catch(() => void 0);
-			throw error;
-		} finally {
-			unlock.ed25519ExportRootCustody.factorSecret32.fill(0);
-		}
-	}
-	async requestEmailOtpSigningSessionChallenge(args) {
-		return await requestEmailOtpSigningSessionChallenge(this.emailOtpPublicDeps, args);
-	}
-	async refreshEmailOtpSigningSession(args) {
-		return await refreshEmailOtpSigningSession(this.emailOtpPublicDeps, args);
-	}
-	async enrollEmailOtpInternal(args) {
-		return await enrollEmailOtpInternal(this.emailOtpPublicDeps, args);
-	}
-	async prepareEmailOtpRegistrationEnrollmentMaterialInternal(args) {
-		return await prepareEmailOtpRegistrationEnrollmentMaterialInternal(this.emailOtpPublicDeps, args);
-	}
-	async getWarmThresholdEd25519SessionStatus(args) {
-		const walletId = toWalletId(args.walletId);
-		const resolution = await resolveExactEd25519SealedSessionRuntimeForWalletSubject({
-			walletId,
-			nearAccountId: toAccountId(args.nearAccountId),
-			nearEd25519SigningKeyId: nearEd25519SigningKeyIdFromString(args.nearEd25519SigningKeyId)
-		});
-		if (resolution.kind === "missing") return null;
-		if (resolution.kind !== "resolved") throw new Error(`[WarmSessionStore] Ed25519 sealed runtime is ${resolution.kind}`);
-		const authorization = await this.resolveActiveNearEd25519WalletSessionAuthorization(walletId);
-		return await getWarmThresholdEd25519SessionStatus(this.warmCapabilitiesPublicDeps, {
-			runtime: resolution.runtime,
-			authorization,
-			nowMs: Date.now()
-		});
-	}
-	async scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(args, statusReads) {
-		const capabilities = await this.listPreprocessingCapabilities({
-			walletId: args.walletId,
-			chainTargets: [args.chainTarget]
-		}, statusReads);
-		const authorized = capabilities.length === 1 ? capabilities[0] : null;
-		if (!authorized) return {
-			status: "skipped",
-			reason: "exact_wallet_session_unavailable",
-			walletSessionId: null
-		};
-		return await scheduleRouterAbEcdsaDerivationLoginPresignaturePrefill(this.warmCapabilitiesPublicDeps, {
-			capability: authorized,
-			waitForPoolReady: args.waitForPoolReady
-		});
-	}
-	async clearVolatileWarmSigningMaterial(walletId) {
-		const cleanup = this.clearVolatileWarmSigningMaterialInternal(walletId);
-		this.volatileWarmSigningMaterialCleanupInFlight = cleanup;
-		try {
-			await cleanup;
-		} finally {
-			if (this.volatileWarmSigningMaterialCleanupInFlight === cleanup) this.volatileWarmSigningMaterialCleanupInFlight = null;
-		}
-	}
-	async deleteDurableEcdsaPresignatures(target) {
-		return await new IndexedDbEcdsaCapabilityManifestStore().deleteClientPresignatures(target);
-	}
-	async clearVolatileWarmSigningMaterialInternal(walletId) {
-		try {
-			if (walletId) this.enginePorts.ed25519YaoActiveClients.disposeWallet(walletId);
-			else this.enginePorts.ed25519YaoActiveClients.dispose();
-		} finally {
-			try {
-				await clearVolatileWarmSigningMaterial(this.warmCapabilitiesPublicDeps, walletId);
-			} finally {
-				try {
-					if (walletId === void 0) await this.clearLinkedEcdsaHolderMaterials();
-					else await this.clearLinkedEcdsaHolderMaterialsForWallet(walletId);
-				} finally {
-					await this.signerWorkerManager.clearEcdsaClientWorkerState(walletId === void 0 ? { kind: "all" } : {
-						kind: "wallet",
-						walletId
-					});
-				}
-			}
-		}
-	}
-	onSdkLifecycleEvent(listener) {
-		this.sdkLifecycleEventListeners.add(listener);
-		return this.removeSdkLifecycleEventListener.bind(this, listener);
-	}
-	publishSdkLifecycleEvent(event) {
-		const deliveryKey = sdkLifecycleEventDeliveryKey(event);
-		if (this.deliveredSdkLifecycleEventKeys.has(deliveryKey)) return;
-		this.deliveredSdkLifecycleEventKeys.add(deliveryKey);
-		for (const listener of Array.from(this.sdkLifecycleEventListeners)) listener(event);
-	}
-	publishNearProvisioningLifecycleEvent(walletId, state) {
-		this.publishSdkLifecycleEvent(createNearProvisioningStateChangedEvent({
-			walletId,
-			state
-		}));
-	}
-	removeSdkLifecycleEventListener(listener) {
-		this.sdkLifecycleEventListeners.delete(listener);
-	}
-	dispose() {
-		this.signingSessionLifecycleSubscription.unsubscribe();
-		this.nearProvisioningUnsubscribe();
-		this.sdkLifecycleEventListeners.clear();
-		this.deliveredSdkLifecycleEventKeys.clear();
-		this.ed25519YaoPageLifecycleOwner.dispose();
-	}
-	clearThresholdEcdsaSigningQueue() {
-		clearThresholdCommitQueue(this.thresholdEcdsaSigningQueueByKey);
-	}
-	async clearLinkedEcdsaHolderMaterials() {
-		await clearLinkedDeviceEcdsaHolderMaterialsWasm({ workerCtx: this.signerWorkerManager.getContext() });
-		clearLinkedEcdsaHolderRuntimesV1();
-	}
-	async clearLinkedEcdsaHolderMaterialsForWallet(walletId) {
-		const runtimes = listLinkedEcdsaHolderRuntimesV1(walletId);
-		let firstError;
-		for (const runtime of runtimes) try {
-			await destroyLinkedDeviceEcdsaHolderMaterialsWasm({
-				holderHandleIds: [runtime.holderHandleId],
-				workerCtx: this.signerWorkerManager.getContext()
-			});
-			removeLinkedEcdsaHolderRuntimeV1(runtime);
-		} catch (error) {
-			firstError ??= error;
-		}
-		if (firstError !== void 0) throw firstError;
-	}
-};
-//#endregion
-export { BrowserSigningSurface };
-
-//# sourceMappingURL=BrowserSigningSurface.js.map