@seams/wallet 0.8.0 → 0.9.1

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaLogin.js

@@ -1,930 +0,0 @@
-import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
-import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { sameRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import { buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, buildEvmFamilyEcdsaSessionLanePolicy, toEvmFamilyEcdsaKeyHandle } from "../identity/evmFamilyEcdsaIdentity.js";
-import { DEFAULT_THRESHOLD_SESSION_POLICY, DEFAULT_UNLOCK_REMAINING_USES, clampThresholdSessionPolicy, resolveWalletUnlockSessionUsesFromRequestedUses } from "../../threshold/sessionPolicy.js";
-import { buildEmailOtpWalletAuthAuthority, isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
-import { buildEmailOtpAuthContextForCanonicalWallet, buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, isEmailOtpPendingSingleUseAuthContext, isEmailOtpSessionAuthContext } from "../identity/laneIdentity.js";
-import { resolveExactWalletAuthAuthority } from "../identity/ownerLaneScope.js";
-import { assertEmailOtpSigningSessionAuthLane, buildEmailOtpSigningSessionRoutePlan, emailOtpEcdsaBootstrapRouteAuthFromRoutePlan } from "./routePlan.js";
-import { buildStrictEcdsaPostRegistrationSessionActivationRequest, isEcdsaCredentialFreeSessionActivationAuthorization } from "../../threshold/ecdsa/postRegistrationSessionActivation.js";
-import { buildEmailOtpExplicitExportEcdsaActivation, buildEmailOtpPerOperationReauthEcdsaActivation, buildEmailOtpPreauthorizedSessionBootstrapEcdsaActivation, buildEmailOtpRecoveredSessionEcdsaActivation, buildEmailOtpSessionBootstrapEcdsaActivation } from "../passkey/ecdsaSessionProvision.js";
-import { establishUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../../walletCustody/unlockedEd25519ExportRootCapability.js";
-import { unlockEmailOtpWallet, unlockEmailOtpWalletCapabilities } from "./walletUnlock.js";
-import { disposeWalletCustodyEd25519ActiveClientV1 } from "../../walletCustody/ed25519ActiveClient.js";
-import { generateSessionId } from "../passkey/prfCache.js";
-import { commitEmailOtpEcdsaPublicationBootstraps, emailOtpEcdsaPublicationChainTargets, projectEmailOtpExistingEcdsaKeyToChainTarget, resolveEmailOtpExistingEcdsaKey } from "./ecdsaPublication.js";
-import { buildEcdsaSessionIdentity } from "../warmCapabilities/ecdsaProvisionPlan.js";
-//#region src/core/signingEngine/session/emailOtp/ecdsaLogin.ts
-function emailOtpEd25519YaoLoginMaterialFromWorkerResult(workerResult) {
-	if (!workerResult) return { kind: "not_requested" };
-	switch (workerResult.kind) {
-		case "wallet_custody_cache_absent": return {
-			kind: "cache_absent",
-			bootstrap: workerResult.ed25519YaoRecovery
-		};
-		case "ed25519_yao_capability": return {
-			kind: "capability",
-			activeClientHandle: workerResult.activeClientHandle,
-			metadata: workerResult.metadata,
-			bootstrap: workerResult.ed25519YaoCapability
-		};
-	}
-	throw new Error("Unsupported Email OTP Ed25519 unlock material");
-}
-async function disposeEmailOtpEd25519YaoWorkerResultAfterFailure(args) {
-	if (!args.workerResult) return;
-	switch (args.workerResult.kind) {
-		case "wallet_custody_cache_absent": return;
-		case "ed25519_yao_capability":
-			if (!await disposeWalletCustodyEd25519ActiveClientV1({
-				workerContext: args.workerContext,
-				activeClientHandle: args.workerResult.activeClientHandle
-			})) throw new Error("Email OTP capability unlock local Ed25519 client was unavailable");
-			return;
-	}
-	args.workerResult;
-}
-function nowMs() {
-	return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
-}
-async function establishEmailOtpUnlockedEd25519ExportRootCapability(args) {
-	try {
-		await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.workerContext), {
-			existingEnvelope: args.unlock.ed25519ExportRootCustody.existingEnvelope,
-			existingFactorSecret: args.unlock.ed25519ExportRootCustody.factorSecret32,
-			walletId: String(args.authorization.record.walletId),
-			walletAuthMethodId: args.walletAuthMethodId,
-			walletSessionId: String(args.authorization.operationCredential.walletSessionId),
-			expiresAtMs: args.authorization.record.expiresAtMs
-		});
-	} catch (error) {
-		console.warn("[SigningEngine][email-otp] unlocked Ed25519 export-root capability was not established:", error instanceof Error ? error.message : String(error || "unknown error"));
-	}
-}
-function createEmailOtpThresholdEcdsaLoginTimings() {
-	return {
-		emailOtpProofVerificationMs: 0,
-		ecdsaMaterialRestoreMs: 0,
-		signingSessionSealApplyMs: 0,
-		warmCapabilityPersistenceMs: 0
-	};
-}
-function addEmailOtpThresholdEcdsaLoginTiming(timings, bucket, startedAtMs) {
-	timings[bucket] += Math.max(0, Math.round(nowMs() - startedAtMs));
-}
-function mergeEmailOtpEcdsaPublicationTimingsIntoLoginTimings(target, source) {
-	target.signingSessionSealApplyMs += source.signingSessionSealApplyMs;
-	target.warmCapabilityPersistenceMs += source.warmCapabilityPersistenceMs;
-}
-function normalizeEmailOtpProviderUserId(value, field) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[SigningEngine][email-otp] ${field} is required`);
-	return normalized;
-}
-function resolveEmailOtpEcdsaProviderIdentity(args) {
-	return {
-		provider: args.identity.provider,
-		providerUserId: normalizeEmailOtpProviderUserId(args.identity.providerUserId, "Email OTP provider user id")
-	};
-}
-/**
-* The active Email OTP method whose identity the caller is presenting.
-*
-* Exactly one must match: the identity is the provider subject plus the email
-* hash, so two active methods answering to it would mean the wallet cannot say
-* which credential just proved itself. Nothing matching is not an error - a
-* wallet with no such method falls back to the canonical boundary as before.
-*/
-async function resolveEmailOtpAuthContextAuthorityFromActiveMethods(args) {
-	const localMethods = await args.ownerLaneScopeStores.listWalletAuthMethodsForWallet(String(args.walletId));
-	const matches = [];
-	for (const local of localMethods) {
-		if (local.kind !== "email_otp" || local.status !== "active") continue;
-		if (String(local.walletId) !== String(args.walletId)) continue;
-		if (String(local.emailHashHex) !== String(args.emailHashHex)) continue;
-		const authority = local.authority;
-		if (String(authority.walletId) !== String(args.walletId) || authority.factor.provider !== args.provider || String(authority.factor.providerUserId) !== String(args.providerUserId) || String(authority.verifier.emailHashHex) !== String(args.emailHashHex)) continue;
-		matches.push(authority);
-	}
-	const [authority, ...remaining] = matches;
-	if (!authority) return { kind: "canonical_boundary" };
-	if (remaining.length > 0) throw new Error("Email OTP identity matches more than one active wallet auth method");
-	return {
-		kind: "selected_v2",
-		authority
-	};
-}
-function resolveEmailOtpAuthContextAuthorityForExactMethod(args) {
-	const parsedWalletAuthMethodId = parseWalletAuthMethodId(args.walletAuthMethodId);
-	if (!parsedWalletAuthMethodId.ok) throw new Error("Selected Email OTP wallet auth method is invalid");
-	const baseAuthority = buildEmailOtpWalletAuthAuthority({
-		walletId: args.walletId,
-		provider: args.provider,
-		providerUserId: args.providerUserId,
-		emailHashHex: args.emailHashHex
-	});
-	return {
-		kind: "selected_v2",
-		authority: {
-			walletId: baseAuthority.walletId,
-			factor: baseAuthority.factor,
-			verifier: baseAuthority.verifier,
-			bindingId: parsedWalletAuthMethodId.value
-		}
-	};
-}
-async function resolveEmailOtpAuthContextAuthoritySource(args) {
-	if (args.authoritySelector.kind === "wallet_auth_method") return await resolveEmailOtpAuthContextAuthorityForExactMethod({
-		walletId: args.walletId,
-		walletAuthMethodId: args.authoritySelector.walletAuthMethodId,
-		emailHashHex: args.emailHashHex,
-		provider: args.provider,
-		providerUserId: args.providerUserId
-	});
-	const selected = await args.authorityPorts.resolveSelectedWalletAuthority(String(args.walletId));
-	if (selected.kind === "missing_selection") return { kind: "canonical_boundary" };
-	if (selected.kind !== "resolved") throw new Error(`Email OTP authority selection is unavailable: ${selected.kind}`);
-	if (selected.authMethod.kind !== "email_otp") return await resolveEmailOtpAuthContextAuthorityFromActiveMethods({
-		walletId: args.walletId,
-		emailHashHex: args.emailHashHex,
-		provider: args.provider,
-		providerUserId: args.providerUserId,
-		ownerLaneScopeStores: args.authorityPorts.ownerLaneScopeStores
-	});
-	if (selected.authMethod.status !== "active" || selected.authority.state !== "active" || String(selected.authMethod.walletId) !== String(args.walletId) || String(selected.authority.walletId) !== String(args.walletId) || String(selected.authMethod.walletAuthorityId) !== String(selected.authority.authorityId)) throw new Error("Email OTP authority selected by the wallet is not active");
-	const authMethod = selected.authMethod;
-	const authMethodId = String(authMethod.walletAuthMethodId);
-	const authority = await resolveExactWalletAuthAuthority({
-		authMethod,
-		stores: args.authorityPorts.ownerLaneScopeStores
-	});
-	if (!isEmailOtpWalletAuthAuthority(authority)) throw new Error("Email OTP authority selected by the wallet session has the wrong factor");
-	const authorityRef = await walletAuthAuthorityRef({ authority });
-	if (String(authorityRef.walletId) !== String(selected.authority.walletId) || String(authorityRef.walletAuthMethodId) !== authMethodId || String(authority.verifier.emailHashHex) !== String(args.emailHashHex) || authority.factor.provider !== args.provider || String(authority.factor.providerUserId) !== String(args.providerUserId)) throw new Error("Email OTP authority selected by the wallet session does not match the request");
-	return {
-		kind: "selected_v2",
-		authority
-	};
-}
-function emailOtpEcdsaScopeForAuthoritySource(args) {
-	if (args.source.kind === "selected_v2" && !args.runtimePolicyScope) return {
-		kind: "exact_authority",
-		authorityRef: args.authorityRef
-	};
-	if (!args.runtimePolicyScope) return { kind: "durable_manifest" };
-	return {
-		kind: "exact",
-		runtimePolicyScope: args.runtimePolicyScope,
-		authorityRef: args.authorityRef
-	};
-}
-function requireEmailOtpExplicitExportInput(args) {
-	if ("persistedExportMaterial" in args && "explicitExportAuthorization" in args && args.operation === "export_key") return args;
-	throw new Error("Email OTP ECDSA export requires prepared operation authorization");
-}
-function requireEmailOtpExplicitExportUnsealGrant(authorization) {
-	switch (authorization.unseal.kind) {
-		case "email_otp_grant": return {
-			kind: "email_otp_unseal_grant",
-			grant: authorization.unseal.grant,
-			challengeId: authorization.unseal.challenge_id
-		};
-		case "not_requested": throw new Error("Email OTP ECDSA export requires its verified unseal grant");
-		default: {
-			const exhaustive = authorization.unseal;
-			throw new Error(`Unsupported Email OTP ECDSA export unseal state: ${String(exhaustive)}`);
-		}
-	}
-}
-function assertEmailOtpOperationMatchesRoutePlan(args) {
-	if (args.operation !== args.routePlan.operation) throw new Error("Email OTP operation does not match its route plan");
-}
-function assertEmailOtpEcdsaExportHandleMatchesLane(args) {
-	const walletKey = args.existingKey.walletKey;
-	if (String(args.handle.walletId) !== String(walletKey.walletId) || String(args.handle.keyHandle) !== String(walletKey.keyHandle) || args.handle.authSubjectId !== emailOtpAuthContextProviderUserId(args.emailOtpAuthContext) || !thresholdEcdsaChainTargetsEqual(args.handle.chainTarget, walletKey.chainTarget) || !thresholdEcdsaChainTargetsEqual(args.handle.chainTarget, args.chainTarget)) throw new Error("Email OTP ECDSA export worker handle does not match the resolved lane");
-}
-function requireEmailOtpEcdsaExportAuthContext(context) {
-	if (!isEmailOtpPendingSingleUseAuthContext(context)) throw new Error("Email OTP ECDSA export requires single-use authorization");
-	return context;
-}
-function buildEmailOtpEcdsaOnlySigningBudget(args) {
-	const policy = clampThresholdSessionPolicy({
-		ttlMs: args.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-		remainingUses: args.remainingUses
-	});
-	return {
-		ttlMs: policy.ttlMs,
-		remainingUses: policy.remainingUses
-	};
-}
-function buildAuthoritativeEmailOtpMixedWalletSigningBudget(args) {
-	const session = args.bootstrap.session;
-	const expiresAtMs = Math.floor(Number(session.expiresAtMs));
-	const remainingUses = Math.floor(Number(session.remainingUses));
-	const ttlMs = expiresAtMs - Date.now();
-	if (!Number.isSafeInteger(expiresAtMs) || ttlMs < 1) throw new Error("Email OTP capability unlock returned an invalid server signing budget");
-	if (remainingUses !== args.expectedRemainingUses) throw new Error("Email OTP capability unlock changed the requested signing budget uses");
-	return {
-		ttlMs,
-		remainingUses
-	};
-}
-function resolveEmailOtpLoginSigningBudget(args) {
-	if (args.ed25519YaoResult) return buildAuthoritativeEmailOtpMixedWalletSigningBudget({
-		bootstrap: args.ed25519YaoResult.kind === "wallet_custody_cache_absent" ? args.ed25519YaoResult.ed25519YaoRecovery : args.ed25519YaoResult.ed25519YaoCapability,
-		expectedRemainingUses: args.requestedRemainingUses
-	});
-	return buildEmailOtpEcdsaOnlySigningBudget({
-		ttlMs: args.requestedTtlMs,
-		remainingUses: args.requestedRemainingUses
-	});
-}
-function requireEmailOtpUnlockSessionPolicy(value) {
-	if (!value) throw new Error("Email OTP capability recovery requires explicit wallet unlock");
-	return value;
-}
-function emailOtpUnlockSessionPolicyFromActivationRequest(args) {
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: String(args.keyHandle),
-		session_policy: args.request.session_policy
-	};
-}
-function buildEmailOtpUnlockSessionPolicy(args) {
-	return {
-		kind: "router_ab_ecdsa_post_registration_session_activation_policy_v1",
-		key_handle: String(args.keyHandle),
-		session_policy: {
-			threshold_session_id: requireEmailOtpUnlockThresholdSessionId(args.thresholdSessionId),
-			wallet_session_mint_id: requireEmailOtpUnlockWalletSessionMintId(args.walletSessionMintId),
-			ttl_ms: args.ttlMs,
-			remaining_uses: args.remainingUses,
-			runtime_policy_scope: args.runtimePolicyScope
-		}
-	};
-}
-function requireEmailOtpUnlockSessionResponse(result, walletSessionAuthorization) {
-	if (result.operation !== "wallet_unlock" || !result.ecdsaSession) throw new Error("Email OTP unlock did not return its ECDSA Wallet Session");
-	if (result.ecdsaSession.kind === "router_ab_ecdsa_credential_free_session_activated_v1") {
-		if (!walletSessionAuthorization) throw new Error("Email OTP combined unlock did not return its exact Wallet Session");
-		return {
-			kind: "credential_free_ecdsa_session_activation_authorization_v1",
-			activation: result.ecdsaSession,
-			authorization: walletSessionAuthorization
-		};
-	}
-	return result.ecdsaSession;
-}
-function requirePreparedEmailOtpUnlockSessionResponse(value) {
-	if (!value) throw new Error("Email OTP unlock did not return its prepared ECDSA Wallet Session");
-	return value;
-}
-function requireEmailOtpEcdsaCustodySigner(continuity, walletId, keyHandle) {
-	const first = continuity.signers[0];
-	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
-	if (first.walletKey.walletId !== walletId || first.walletKey.keyHandle !== keyHandle) throw new Error("Email OTP ECDSA custody continuity changed the requested wallet key");
-	for (const signer of continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
-	return first;
-}
-function nonEmptyEmailOtpEcdsaChainTargets(continuity) {
-	const [first, ...rest] = continuity.signers;
-	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
-	return [first.chainTarget, ...rest.map((signer) => signer.chainTarget)];
-}
-async function restoreEmailOtpEcdsaCustodyContinuity(args) {
-	const custody = args.restore.ecdsaCustody;
-	const signer = requireEmailOtpEcdsaCustodySigner(custody.continuity, args.walletId, args.keyHandle);
-	await args.restoreWalletCustodyEcdsaContinuity({
-		authority: args.authority,
-		chainTargets: nonEmptyEmailOtpEcdsaChainTargets(custody.continuity),
-		walletId: signer.walletKey.walletId,
-		keyHandle: signer.walletKey.keyHandle,
-		ecdsaThresholdKeyId: signer.walletKey.ecdsaThresholdKeyId,
-		signingRootId: signer.walletKey.signingRootId,
-		signingRootVersion: signer.walletKey.signingRootVersion,
-		relayerKeyId: signer.walletKey.relayerKeyId,
-		participantIds: signer.walletKey.participantIds,
-		publicCapability: signer.walletKey.publicCapability,
-		activationReceipt: signer.activationReceipt,
-		runtimePolicyScope: signer.runtimePolicyScope,
-		readyStateBlobB64u: custody.readyStateBlobB64u,
-		publicFacts: custody.publicFacts
-	});
-}
-function requireEmailOtpUnlockThresholdSessionId(value) {
-	const parsed = parseThresholdEcdsaSessionId(value);
-	if (!parsed.ok) throw new Error("Failed to create Email OTP threshold session identity");
-	return parsed.value;
-}
-function requireEmailOtpUnlockWalletSessionMintId(value) {
-	const parsed = parseWalletSessionMintId(value);
-	if (!parsed.ok) throw new Error("Failed to create Email OTP Wallet Session mint identity");
-	return parsed.value;
-}
-function requireEmailOtpBootstrapTransportAuth(value) {
-	if (!value) throw new Error("Email OTP ECDSA bootstrap requires route auth");
-	return value;
-}
-function emailOtpNonUnlockWorkerHandleOperationFromLoginOperation(operation) {
-	switch (operation) {
-		case WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION: return "sign";
-		case WALLET_EMAIL_OTP_EXPORT_OPERATION: return "export";
-		case WALLET_EMAIL_OTP_UNLOCK_OPERATION: throw new Error("Email OTP wallet unlock requires first-session activation");
-		case WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION: throw new Error("Email OTP device linking requires linked-device activation");
-		case "registration": throw new Error("Email OTP ECDSA registration requires wallet-registration prepare");
-	}
-	throw new Error("Unsupported Email OTP non-unlock operation");
-}
-function emailOtpNonUnlockEcdsaHandleBinding(args) {
-	switch (args.operation) {
-		case "sign": return {
-			keyHandle: args.keyHandle,
-			authSubjectId: args.authSubjectId,
-			operation: "sign",
-			chainTarget: args.chainTarget
-		};
-		case "export": return {
-			keyHandle: args.keyHandle,
-			authSubjectId: args.authSubjectId,
-			operation: "export",
-			chainTarget: args.chainTarget
-		};
-	}
-	args.operation;
-	throw new Error("Unsupported Email OTP non-unlock handle operation");
-}
-function buildEmailOtpExistingKeyActivation(args) {
-	if (args.emailOtpWorkerSessionHandle.action !== "threshold_ecdsa_bootstrap") throw new Error("Email OTP ECDSA activation requires a threshold ECDSA worker handle");
-	const sessionIdentity = buildEcdsaSessionIdentity({ thresholdSessionId: args.thresholdSessionId });
-	const lanePolicy = buildEvmFamilyEcdsaSessionLanePolicy({
-		chainTarget: args.chainTarget,
-		thresholdSessionId: sessionIdentity.thresholdSessionId,
-		ttlMs: args.ttlMs,
-		remainingUses: args.remainingUses,
-		runtimePolicyScope: args.runtimePolicyScope
-	});
-	if (isEmailOtpSessionAuthContext(args.emailOtpAuthContext)) {
-		const common = {
-			source: "email_otp",
-			relayerUrl: args.relayerUrl,
-			sessionIdentity,
-			sessionKind: "opaque",
-			sessionBudgetUses: args.remainingUses,
-			runtimePolicy: {
-				kind: "scoped_policy",
-				scope: args.runtimePolicyScope
-			},
-			emailOtpWorkerSessionHandle: args.emailOtpWorkerSessionHandle,
-			emailOtpAuthContext: args.emailOtpAuthContext,
-			walletKey: args.existingKey.walletKey,
-			lanePolicy,
-			publicCapability: args.existingKey.publicCapability,
-			existingRoleLocalMaterial: args.existingKey.persistedRoleLocalMaterial
-		};
-		return args.authorization.kind === "preauthorized_wallet_unlock" ? buildEmailOtpPreauthorizedSessionBootstrapEcdsaActivation({
-			...common,
-			preauthorizedSessionActivation: args.authorization.sessionActivation
-		}) : buildEmailOtpSessionBootstrapEcdsaActivation({
-			...common,
-			walletSessionRouteAuth: args.authorization.routeAuth
-		});
-	}
-	if (isEmailOtpPendingSingleUseAuthContext(args.emailOtpAuthContext)) {
-		if (args.authorization.kind === "preauthorized_wallet_unlock") throw new Error("Email OTP operation step-up cannot adopt a reusable Wallet Session");
-		return buildEmailOtpPerOperationReauthEcdsaActivation({
-			source: "email_otp",
-			relayerUrl: args.relayerUrl,
-			sessionIdentity,
-			sessionKind: "opaque",
-			sessionBudgetUses: args.remainingUses,
-			runtimePolicy: {
-				kind: "scoped_policy",
-				scope: args.runtimePolicyScope
-			},
-			emailOtpWorkerSessionHandle: args.emailOtpWorkerSessionHandle,
-			emailOtpAuthContext: args.emailOtpAuthContext,
-			walletSessionRouteAuth: args.authorization.routeAuth,
-			walletKey: args.existingKey.walletKey,
-			lanePolicy,
-			publicCapability: args.existingKey.publicCapability,
-			existingRoleLocalMaterial: args.existingKey.persistedRoleLocalMaterial
-		});
-	}
-	throw new Error("Email OTP ECDSA activation cannot use a consumed single-use context");
-}
-function buildEmailOtpRecoveredKeyActivation(args) {
-	if (args.emailOtpWorkerSessionHandle.action !== "threshold_ecdsa_bootstrap") throw new Error("Email OTP ECDSA recovery requires a threshold ECDSA worker handle");
-	const thresholdSessionId = SigningSessionIds.thresholdEcdsaSession(args.thresholdSessionId);
-	return buildEmailOtpRecoveredSessionEcdsaActivation({
-		source: "email_otp",
-		relayerUrl: args.relayerUrl,
-		sessionIdentity: {
-			kind: "recovered_material_session",
-			thresholdSessionId,
-			materialActivation: args.existingKey.persistedRoleLocalMaterial.materialActivation
-		},
-		sessionKind: "opaque",
-		sessionBudgetUses: args.remainingUses,
-		runtimePolicy: {
-			kind: "scoped_policy",
-			scope: args.runtimePolicyScope
-		},
-		emailOtpWorkerSessionHandle: args.emailOtpWorkerSessionHandle,
-		emailOtpAuthContext: args.emailOtpAuthContext,
-		walletSessionRouteAuth: args.routeAuth,
-		walletKey: args.existingKey.walletKey,
-		lanePolicy: buildEvmFamilyEcdsaRecoveredMaterialLanePolicy({
-			chainTarget: args.chainTarget,
-			thresholdSessionId,
-			ttlMs: args.ttlMs,
-			remainingUses: args.remainingUses,
-			runtimePolicyScope: args.runtimePolicyScope
-		}),
-		publicCapability: args.existingKey.publicCapability,
-		existingRoleLocalMaterial: args.existingKey.persistedRoleLocalMaterial
-	});
-}
-function resolveEmailOtpPrimaryEcdsaSessionProvisioning(provisioning) {
-	switch (provisioning.kind) {
-		case "route_authorized": return {
-			sessionIdentity: provisioning.sessionIdentity,
-			authorization: {
-				kind: "route_authorized",
-				routeAuth: provisioning.routeAuth
-			}
-		};
-		case "preauthorized_wallet_unlock": {
-			const policy = provisioning.request.session_policy;
-			const session = isEcdsaCredentialFreeSessionActivationAuthorization(provisioning.response) ? provisioning.response.activation.session : provisioning.response.session;
-			if (policy.threshold_session_id !== session.threshold_session_id) throw new Error("Email OTP unlock returned a different prepared ECDSA session identity");
-			return {
-				sessionIdentity: buildEcdsaSessionIdentity({ thresholdSessionId: session.threshold_session_id }),
-				authorization: {
-					kind: "preauthorized_wallet_unlock",
-					sessionActivation: provisioning.response
-				}
-			};
-		}
-	}
-}
-async function provisionEmailOtpExistingKeySessions(args) {
-	const emailOtpWorkerSessionHandle = parseEmailOtpWorkerIssuedSessionHandle(args.emailOtpSessionHandle);
-	if (emailOtpWorkerSessionHandle.action !== "threshold_ecdsa_bootstrap") throw new Error("Email OTP wallet unlock returned an invalid ECDSA worker handle");
-	const primarySession = resolveEmailOtpPrimaryEcdsaSessionProvisioning(args.primarySession);
-	const provisionContext = {
-		args,
-		sessionIdentity: primarySession.sessionIdentity,
-		authorization: primarySession.authorization,
-		emailOtpWorkerSessionHandle
-	};
-	const primaryTarget = args.publicationChainTargets[0];
-	if (!primaryTarget) throw new Error("Email OTP ECDSA activation requires a primary target");
-	const primaryBootstrap = await provisionEmailOtpExistingKeySessionForTarget(provisionContext, primaryTarget);
-	const additionalAuthorization = args.primarySession.kind === "preauthorized_wallet_unlock" ? primarySession.authorization : {
-		kind: "route_authorized",
-		routeAuth: primaryBootstrap.session.operationCredential
-	};
-	const additionalContext = {
-		...provisionContext,
-		args: {
-			...args,
-			primarySession: {
-				kind: "route_authorized",
-				sessionIdentity: primarySession.sessionIdentity,
-				routeAuth: primaryBootstrap.session.operationCredential
-			}
-		},
-		authorization: additionalAuthorization
-	};
-	const bootstraps = [primaryBootstrap, ...await Promise.all(args.publicationChainTargets.slice(1).map(provisionEmailOtpExistingKeySessionForTarget.bind(null, additionalContext)))];
-	if (!primaryBootstrap) throw new Error("Email OTP ECDSA activation did not return a primary warm session");
-	return bootstraps;
-}
-async function provisionEmailOtpExistingKeySessionForTarget(context, chainTarget) {
-	const existingKey = projectEmailOtpExistingEcdsaKeyToChainTarget({
-		existingKey: context.args.primaryExistingKey,
-		chainTarget
-	});
-	return await context.args.ports.provisionThresholdEcdsaSession(buildEmailOtpExistingKeyActivation({
-		existingKey,
-		chainTarget,
-		thresholdSessionId: context.sessionIdentity.thresholdSessionId,
-		ttlMs: context.args.ttlMs,
-		remainingUses: context.args.remainingUses,
-		runtimePolicyScope: context.args.runtimePolicyScope,
-		relayerUrl: context.args.relayerUrl,
-		emailOtpAuthContext: context.args.emailOtpAuthContext,
-		emailOtpWorkerSessionHandle: context.emailOtpWorkerSessionHandle,
-		authorization: context.authorization
-	}));
-}
-async function provisionEmailOtpExplicitExportSession(args) {
-	return await args.ports.provisionEmailOtpEcdsaExplicitExportSession(buildEmailOtpExplicitExportEcdsaActivation({
-		relayerUrl: args.relayerUrl,
-		existingRoleLocalMaterial: args.persistedMaterial,
-		authorization: args.authorization
-	}));
-}
-function normalizeEmailOtpEcdsaSigningRemainingUses(value) {
-	const remainingUses = Math.floor(Number(value) || 0);
-	if (!Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("[SigningEngine][email-otp][ecdsa] signing remainingUses is required");
-	return remainingUses;
-}
-function requireEmailOtpEcdsaSigningRefreshRuntimePolicyScope(args) {
-	const runtimePolicyScope = args.runtimePolicyScope;
-	if (!runtimePolicyScope) throw new Error("Email OTP ECDSA signing refresh requires runtimePolicyScope");
-	return runtimePolicyScope;
-}
-function buildDurableAuthorityEmailOtpEcdsaSigningRefreshFacts(committedLane) {
-	if (committedLane.authority.factor.kind !== "email_otp" || !committedLane.authLane) throw new Error("[SigningEngine][email-otp][ecdsa] committed lane requires Email OTP authority");
-	return {
-		keyHandle: String(toEvmFamilyEcdsaKeyHandle(committedLane.lane.identity.signer.keyHandle)),
-		participantIds: committedLane.lane.identity.signer.key.participantIds.map(Number),
-		emailHashHex: committedLane.authority.verifier.emailHashHex,
-		providerIdentity: {
-			kind: "explicit_provider_user",
-			provider: committedLane.authority.factor.provider,
-			providerUserId: committedLane.authority.factor.providerUserId
-		}
-	};
-}
-async function buildEmailOtpEcdsaSigningRefreshFacts(args) {
-	const runtimeResolution = await args.resolveCurrentEcdsaCapabilityRuntime({
-		walletId: toWalletId(args.committedLane.lane.identity.signer.walletId),
-		chainTarget: args.chainTarget
-	});
-	if (runtimeResolution.kind !== "resolved") throw new Error(`[SigningEngine][email-otp][ecdsa] signing refresh runtime unavailable: ${runtimeResolution.reason}`);
-	if (!mpcMaterialActivationRefsEqual(runtimeResolution.runtime.materialActivation, args.committedLane.lane.materialActivation)) throw new Error("[SigningEngine][email-otp][ecdsa] signing refresh runtime material activation mismatch");
-	return {
-		...buildDurableAuthorityEmailOtpEcdsaSigningRefreshFacts(args.committedLane),
-		runtimePolicyScope: requireEmailOtpEcdsaSigningRefreshRuntimePolicyScope({ runtimePolicyScope: runtimeResolution.runtime.runtimePolicyScope })
-	};
-}
-async function loginWithEmailOtpEcdsaCapabilityForSigning(args, ports) {
-	const operation = WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
-	const emailOtpAuthPolicy = "session";
-	const remainingUses = normalizeEmailOtpEcdsaSigningRemainingUses(args.remainingUses);
-	const committedLane = args.committedLane;
-	const refreshFacts = await buildEmailOtpEcdsaSigningRefreshFacts({
-		committedLane,
-		chainTarget: args.chainTarget,
-		resolveCurrentEcdsaCapabilityRuntime: ports.resolveCurrentEcdsaCapabilityRuntime
-	});
-	const routePlan = buildEmailOtpSigningSessionRoutePlan({
-		authLane: assertEmailOtpSigningSessionAuthLane(committedLane.authLane),
-		operation
-	});
-	return await ports.loginWithEcdsaCapabilityInternal({
-		walletSession: args.walletSession,
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: String((await walletAuthAuthorityRef({ authority: committedLane.authority })).walletAuthMethodId)
-		},
-		chainTarget: args.chainTarget,
-		emailOtpAuthPolicy,
-		emailOtpAuthReason: "sign",
-		challengeId: args.challengeId,
-		otpCode: args.otpCode,
-		operation,
-		keyHandle: refreshFacts.keyHandle,
-		participantIds: refreshFacts.participantIds,
-		routePlan,
-		emailHashHex: refreshFacts.emailHashHex,
-		providerIdentity: refreshFacts.providerIdentity,
-		ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-		remainingUses,
-		runtimePolicyScope: refreshFacts.runtimePolicyScope,
-		ed25519YaoRecovery: { kind: "not_requested" }
-	});
-}
-async function runEmailOtpEcdsaCapability(args, ports) {
-	const operation = args.operation ?? args.routePlan.operation;
-	assertEmailOtpOperationMatchesRoutePlan({
-		operation,
-		routePlan: args.routePlan
-	});
-	const timings = createEmailOtpThresholdEcdsaLoginTimings();
-	const chainTarget = args.chainTarget;
-	const emailOtpAuthPolicy = args.emailOtpAuthPolicy || ports.configs.signing.emailOtp.authPolicy;
-	const emailOtpAuthReason = args.emailOtpAuthReason || "login";
-	const isSigningStepUp = emailOtpAuthReason === "sign";
-	const emailOtpAuthRetention = isSigningStepUp && emailOtpAuthPolicy === "per_operation" ? "single_use" : "session";
-	const emailOtpAuthContextPolicy = emailOtpAuthRetention === "session" ? "session" : emailOtpAuthPolicy;
-	const relayUrl = String(args.relayUrl || ports.requireRelayUrl()).trim();
-	const groupId = String(args.groupId || ports.requireSigningSessionSealGroupId()).trim();
-	const configuredRemainingUses = args.remainingUses;
-	const defaultRemainingUses = ports.configs.signing.sessionDefaults?.remainingUses;
-	const requestedRemainingUses = Math.min(Math.max(1, Math.floor(Number(configuredRemainingUses ?? defaultRemainingUses ?? DEFAULT_UNLOCK_REMAINING_USES) || 1)), DEFAULT_UNLOCK_REMAINING_USES);
-	const requestedStepUpSignatureUses = Math.max(1, Math.floor(Number(configuredRemainingUses) || 1));
-	const unlockRemainingUses = resolveWalletUnlockSessionUsesFromRequestedUses({ requestedRemainingUses }) || (() => {
-		throw new Error("[SigningEngine][email-otp] unlock session uses are required");
-	})();
-	const remainingUses = isSigningStepUp ? requestedStepUpSignatureUses : unlockRemainingUses;
-	const workerCtx = ports.getSignerWorkerContext();
-	const routePlan = args.routePlan;
-	const bootstrapRouteAuth = args.ecdsaBootstrapAuthorization.kind === "route_plan_auth" ? emailOtpEcdsaBootstrapRouteAuthFromRoutePlan(routePlan) : args.ecdsaBootstrapAuthorization.routeAuth;
-	const bootstrapTransportAuth = bootstrapRouteAuth ? bootstrapRouteAuth.operationCredential : void 0;
-	const requestedRuntimePolicyScope = args.runtimePolicyScope;
-	if (!workerCtx) throw new Error("Email OTP login requires the dedicated emailOtp worker");
-	const emailOtpProviderIdentity = resolveEmailOtpEcdsaProviderIdentity({ identity: args.providerIdentity });
-	const emailOtpAuthoritySource = await resolveEmailOtpAuthContextAuthoritySource({
-		walletId: args.walletSession.walletId,
-		authoritySelector: args.authoritySelector,
-		emailHashHex: args.emailHashHex,
-		provider: emailOtpProviderIdentity.provider,
-		providerUserId: emailOtpProviderIdentity.providerUserId,
-		authorityPorts: ports
-	});
-	const emailOtpAuthContext = emailOtpAuthRetention === "single_use" ? emailOtpAuthoritySource.kind === "selected_v2" ? buildEmailOtpAuthContextForWalletAuthMethod({
-		policy: emailOtpAuthContextPolicy,
-		authority: emailOtpAuthoritySource.authority,
-		retention: "single_use"
-	}) : buildEmailOtpAuthContextForCanonicalWallet({
-		policy: emailOtpAuthContextPolicy,
-		walletId: toWalletId(args.walletSession.walletId),
-		emailHashHex: args.emailHashHex,
-		retention: "single_use",
-		provider: emailOtpProviderIdentity.provider,
-		providerUserId: emailOtpProviderIdentity.providerUserId
-	}) : emailOtpAuthoritySource.kind === "selected_v2" ? buildEmailOtpAuthContextForWalletAuthMethod({
-		policy: emailOtpAuthContextPolicy,
-		authority: emailOtpAuthoritySource.authority,
-		retention: "session",
-		reason: emailOtpAuthReason
-	}) : buildEmailOtpAuthContextForCanonicalWallet({
-		policy: emailOtpAuthContextPolicy,
-		walletId: toWalletId(args.walletSession.walletId),
-		emailHashHex: args.emailHashHex,
-		retention: "session",
-		reason: emailOtpAuthReason,
-		provider: emailOtpProviderIdentity.provider,
-		providerUserId: emailOtpProviderIdentity.providerUserId
-	});
-	const emailOtpEcdsaScope = emailOtpEcdsaScopeForAuthoritySource({
-		source: emailOtpAuthoritySource,
-		runtimePolicyScope: requestedRuntimePolicyScope,
-		authorityRef: await walletAuthAuthorityRef({ authority: emailOtpAuthContext.authority })
-	});
-	const publicationChainTargets = emailOtpEcdsaPublicationChainTargets({
-		configs: ports.configs,
-		chainTarget,
-		emailOtpAuthContext,
-		...args.publicationChainTargets ? { additionalChainTargets: args.publicationChainTargets } : {}
-	});
-	const publicationPorts = ports.publicationPorts;
-	const isWalletUnlock = operation === WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-	const requestedKeyHandle = String(args.keyHandle || "").trim();
-	let existingKey = await resolveEmailOtpExistingEcdsaKey({
-		walletId: toWalletId(args.walletSession.walletId),
-		chainTarget,
-		scope: emailOtpEcdsaScope,
-		keyHandle: args.keyHandle,
-		listActiveEcdsaCapabilityManifestsForWallet: publicationPorts.listActiveEcdsaCapabilityManifestsForWallet
-	});
-	if (!existingKey && !isWalletUnlock) throw new Error(`device_link_required: local threshold ECDSA material is unavailable for ${chainTarget.kind}:${chainTarget.chainId}`);
-	const ecdsaKeyHandle = String(existingKey?.keyHandle || requestedKeyHandle).trim();
-	if (!ecdsaKeyHandle) throw new Error("Email OTP ECDSA wallet unlock requires an exact key handle");
-	const runtimePolicyScope = existingKey?.runtimePolicyScope || requestedRuntimePolicyScope;
-	if (!runtimePolicyScope) throw new Error("Email OTP ECDSA wallet unlock requires runtime policy scope");
-	const walletCustodyEd25519Material = args.ed25519YaoRecovery.kind === "requested" ? await ports.loadWalletCustodyEd25519Material({
-		nearAccountId: args.ed25519YaoRecovery.nearAccountId,
-		signerSlot: args.ed25519YaoRecovery.signerSlot
-	}) : null;
-	const preparedUnlockSessionPolicy = isWalletUnlock ? clampThresholdSessionPolicy({
-		ttlMs: args.ttlMs ?? DEFAULT_THRESHOLD_SESSION_POLICY.ttlMs,
-		remainingUses
-	}) : null;
-	const preparedUnlockThresholdSessionId = preparedUnlockSessionPolicy ? requireEmailOtpUnlockThresholdSessionId(generateSessionId("threshold-ecdsa-login")) : null;
-	const preparedUnlockSessionActivation = preparedUnlockSessionPolicy && preparedUnlockThresholdSessionId && existingKey ? buildStrictEcdsaPostRegistrationSessionActivationRequest({
-		publicCapability: existingKey.publicCapability,
-		thresholdSessionId: preparedUnlockThresholdSessionId,
-		walletSessionMintId: requireEmailOtpUnlockWalletSessionMintId(generateSessionId("wallet-session-mint")),
-		ttlMs: preparedUnlockSessionPolicy.ttlMs,
-		remainingUses: preparedUnlockSessionPolicy.remainingUses,
-		runtimePolicyScope
-	}) : null;
-	const preparedUnlockSessionPolicyWire = preparedUnlockSessionPolicy && preparedUnlockThresholdSessionId ? buildEmailOtpUnlockSessionPolicy({
-		keyHandle: ecdsaKeyHandle,
-		thresholdSessionId: preparedUnlockThresholdSessionId,
-		walletSessionMintId: requireEmailOtpUnlockWalletSessionMintId(generateSessionId("wallet-session-mint")),
-		ttlMs: preparedUnlockSessionPolicy.ttlMs,
-		remainingUses: preparedUnlockSessionPolicy.remainingUses,
-		runtimePolicyScope
-	}) : null;
-	let timingStartedAtMs = nowMs();
-	const exportInput = operation === "export_key" ? requireEmailOtpExplicitExportInput(args) : null;
-	const unlockArgs = exportInput ? {
-		walletSession: args.walletSession,
-		authoritySelector: args.authoritySelector,
-		relayUrl,
-		groupId,
-		verification: requireEmailOtpExplicitExportUnsealGrant(exportInput.explicitExportAuthorization),
-		routePlan,
-		workerCtx,
-		runtimePolicyScope,
-		...args.onProgress ? { onProgress: args.onProgress } : {}
-	} : {
-		walletSession: args.walletSession,
-		authoritySelector: args.authoritySelector,
-		relayUrl,
-		groupId,
-		verification: {
-			kind: "otp",
-			...args.challengeId ? { challengeId: args.challengeId } : {},
-			otpCode: args.otpCode
-		},
-		routePlan,
-		workerCtx,
-		runtimePolicyScope,
-		...args.onProgress ? { onProgress: args.onProgress } : {}
-	};
-	const unlockResult = args.ed25519YaoRecovery.kind === "not_requested" ? await unlockEmailOtpWallet({
-		...unlockArgs,
-		...preparedUnlockSessionPolicyWire ? {
-			ecdsaSessionHandleBinding: {
-				keyHandle: ecdsaKeyHandle,
-				authSubjectId: emailOtpProviderIdentity.providerUserId,
-				operation: "wallet_unlock",
-				chainTarget
-			},
-			ecdsaSessionPolicy: preparedUnlockSessionActivation ? emailOtpUnlockSessionPolicyFromActivationRequest({
-				request: preparedUnlockSessionActivation,
-				keyHandle: ecdsaKeyHandle
-			}) : preparedUnlockSessionPolicyWire
-		} : { ecdsaSessionHandleBinding: emailOtpNonUnlockEcdsaHandleBinding({
-			keyHandle: ecdsaKeyHandle,
-			authSubjectId: emailOtpProviderIdentity.providerUserId,
-			operation: emailOtpNonUnlockWorkerHandleOperationFromLoginOperation(routePlan.operation),
-			chainTarget
-		}) }
-	}) : await unlockEmailOtpWalletCapabilities({
-		...unlockArgs,
-		ecdsaSessionHandleBinding: {
-			keyHandle: ecdsaKeyHandle,
-			authSubjectId: emailOtpProviderIdentity.providerUserId,
-			operation: "wallet_unlock",
-			chainTarget
-		},
-		providerSubject: args.ed25519YaoRecovery.providerSubject,
-		signerSlot: args.ed25519YaoRecovery.signerSlot,
-		nearAccountId: args.ed25519YaoRecovery.nearAccountId,
-		expectedOperationalPublicKey: args.ed25519YaoRecovery.expectedOperationalPublicKey,
-		expectedThresholdSessionId: args.ed25519YaoRecovery.expectedThresholdSessionId,
-		walletCustodyEd25519Material: walletCustodyEd25519Material || { kind: "absent" },
-		remainingUses,
-		ecdsaSessionPolicy: preparedUnlockSessionActivation ? emailOtpUnlockSessionPolicyFromActivationRequest({
-			request: preparedUnlockSessionActivation,
-			keyHandle: ecdsaKeyHandle
-		}) : requireEmailOtpUnlockSessionPolicy(preparedUnlockSessionPolicyWire)
-	});
-	const workerResult = unlockResult.kind === "wallet_unlock_capabilities" ? unlockResult.ecdsa : unlockResult;
-	const ed25519YaoResult = unlockResult.kind === "wallet_unlock_capabilities" ? unlockResult.ed25519Yao : null;
-	const walletSessionAuthorization = unlockResult.kind === "wallet_unlock_capabilities" ? unlockResult.walletSessionAuthorization : void 0;
-	try {
-		if (workerResult.operation === "wallet_unlock" && !existingKey) {
-			const restoreAuthority = await walletAuthAuthorityRef({ authority: emailOtpAuthContext.authority });
-			await restoreEmailOtpEcdsaCustodyContinuity({
-				restore: workerResult,
-				walletId: String(args.walletSession.walletId),
-				keyHandle: ecdsaKeyHandle,
-				authority: restoreAuthority,
-				restoreWalletCustodyEcdsaContinuity: ports.restoreWalletCustodyEcdsaContinuity
-			});
-		}
-		if (!existingKey) {
-			existingKey = await resolveEmailOtpExistingEcdsaKey({
-				walletId: toWalletId(args.walletSession.walletId),
-				chainTarget,
-				scope: emailOtpEcdsaScope,
-				keyHandle: ecdsaKeyHandle,
-				listActiveEcdsaCapabilityManifestsForWallet: publicationPorts.listActiveEcdsaCapabilityManifestsForWallet
-			});
-			if (!existingKey) throw new Error("Email OTP ECDSA custody restore did not publish the canonical key");
-		}
-		const effectivePreparedUnlockSessionActivation = preparedUnlockSessionActivation || (preparedUnlockSessionPolicyWire ? buildStrictEcdsaPostRegistrationSessionActivationRequest({
-			publicCapability: existingKey.publicCapability,
-			thresholdSessionId: preparedUnlockSessionPolicyWire.session_policy.threshold_session_id,
-			walletSessionMintId: preparedUnlockSessionPolicyWire.session_policy.wallet_session_mint_id,
-			ttlMs: preparedUnlockSessionPolicyWire.session_policy.ttl_ms,
-			remainingUses: preparedUnlockSessionPolicyWire.session_policy.remaining_uses,
-			runtimePolicyScope
-		}) : null);
-		const exportEmailOtpAuthContext = operation === "export_key" ? requireEmailOtpEcdsaExportAuthContext(emailOtpAuthContext) : null;
-		const exportEmailOtpSessionHandle = operation === "export_key" ? parseEmailOtpEcdsaExportWorkerIssuedSessionHandle(workerResult.emailOtpSessionHandle) : null;
-		if (exportEmailOtpSessionHandle && exportEmailOtpAuthContext) assertEmailOtpEcdsaExportHandleMatchesLane({
-			handle: exportEmailOtpSessionHandle,
-			existingKey,
-			chainTarget,
-			emailOtpAuthContext: exportEmailOtpAuthContext
-		});
-		addEmailOtpThresholdEcdsaLoginTiming(timings, "emailOtpProofVerificationMs", timingStartedAtMs);
-		const preparedUnlockSessionResponse = effectivePreparedUnlockSessionActivation ? requireEmailOtpUnlockSessionResponse(workerResult, walletSessionAuthorization) : null;
-		const sessionPolicy = preparedUnlockSessionResponse ? buildEmailOtpEcdsaOnlySigningBudget({
-			ttlMs: args.ttlMs,
-			remainingUses
-		}) : resolveEmailOtpLoginSigningBudget({
-			ed25519YaoResult,
-			requestedTtlMs: args.ttlMs,
-			requestedRemainingUses: remainingUses
-		});
-		timingStartedAtMs = nowMs();
-		if (operation === "export_key") {
-			if (!exportEmailOtpSessionHandle || !exportEmailOtpAuthContext) throw new Error("Email OTP ECDSA export worker handle is unavailable");
-			const preparedExportInput = requireEmailOtpExplicitExportInput(args);
-			const bootstrap = await provisionEmailOtpExplicitExportSession({
-				relayerUrl: relayUrl,
-				persistedMaterial: preparedExportInput.persistedExportMaterial,
-				authorization: preparedExportInput.explicitExportAuthorization,
-				ports
-			});
-			addEmailOtpThresholdEcdsaLoginTiming(timings, "ecdsaMaterialRestoreMs", timingStartedAtMs);
-			return {
-				kind: "transient_export",
-				value: { bootstrap }
-			};
-		}
-		const bootstraps = await provisionEmailOtpExistingKeySessions({
-			primaryExistingKey: existingKey,
-			publicationChainTargets,
-			runtimePolicyScope,
-			relayerUrl: relayUrl,
-			ttlMs: sessionPolicy.ttlMs,
-			remainingUses: sessionPolicy.remainingUses,
-			emailOtpAuthContext,
-			emailOtpSessionHandle: workerResult.emailOtpSessionHandle,
-			primarySession: effectivePreparedUnlockSessionActivation ? {
-				kind: "preauthorized_wallet_unlock",
-				request: effectivePreparedUnlockSessionActivation,
-				response: requirePreparedEmailOtpUnlockSessionResponse(preparedUnlockSessionResponse)
-			} : {
-				kind: "route_authorized",
-				sessionIdentity: buildEcdsaSessionIdentity({ thresholdSessionId: generateSessionId("threshold-ecdsa-login") }),
-				routeAuth: requireEmailOtpBootstrapTransportAuth(bootstrapTransportAuth)
-			},
-			ports
-		});
-		addEmailOtpThresholdEcdsaLoginTiming(timings, "ecdsaMaterialRestoreMs", timingStartedAtMs);
-		const { bootstrap, authorization, authorizations, timings: publicationTimings } = await commitEmailOtpEcdsaPublicationBootstraps({
-			walletId: toWalletId(args.walletSession.walletId),
-			publicationChainTargets,
-			bootstraps,
-			runtimePolicyScope,
-			authority: existingKey.persistedRoleLocalMaterial.authority,
-			emailOtpAuthContext,
-			relayerUrl: relayUrl,
-			groupId
-		}, publicationPorts);
-		if (unlockResult.kind === "wallet_unlock_capabilities") await establishEmailOtpUnlockedEd25519ExportRootCapability({
-			workerContext: workerCtx,
-			unlock: unlockResult,
-			authorization,
-			walletAuthMethodId: String(emailOtpAuthContext.authority.bindingId)
-		});
-		mergeEmailOtpEcdsaPublicationTimingsIntoLoginTimings(timings, publicationTimings);
-		return {
-			kind: "published_signing_session",
-			value: {
-				recovery: unlockResult.recovery,
-				bootstrap,
-				authorization,
-				authorizations,
-				emailOtpSessionHandle: workerResult.emailOtpSessionHandle,
-				ed25519YaoRecovery: emailOtpEd25519YaoLoginMaterialFromWorkerResult(ed25519YaoResult),
-				timings
-			}
-		};
-	} catch (error) {
-		try {
-			await disposeEmailOtpEd25519YaoWorkerResultAfterFailure({
-				workerResult: ed25519YaoResult,
-				workerContext: workerCtx
-			});
-		} catch (disposalError) {
-			throw new AggregateError([error, disposalError], "Email OTP unlock failed and Ed25519 material disposal failed");
-		}
-		throw error;
-	} finally {
-		if (unlockResult.kind === "wallet_unlock_capabilities") unlockResult.ed25519ExportRootCustody.factorSecret32.fill(0);
-	}
-}
-async function loginWithEmailOtpEcdsaCapability(args, ports) {
-	if ((args.operation ?? args.routePlan.operation) === "export_key") throw new Error("Email OTP ECDSA export must use transient export preparation");
-	const result = await runEmailOtpEcdsaCapability(args, ports);
-	if (result.kind !== "published_signing_session") throw new Error("Email OTP ECDSA login did not publish a signing session");
-	return result.value;
-}
-async function prepareEmailOtpEcdsaExportCapability(args, ports) {
-	const result = await runEmailOtpEcdsaCapability(args, ports);
-	if (result.kind !== "transient_export") throw new Error("Email OTP ECDSA export preparation published a signing session");
-	return result.value;
-}
-//#endregion
-export { buildEmailOtpRecoveredKeyActivation, loginWithEmailOtpEcdsaCapability, loginWithEmailOtpEcdsaCapabilityForSigning, prepareEmailOtpEcdsaExportCapability };
-
-//# sourceMappingURL=ecdsaLogin.js.map