@seams/wallet 0.8.0 → 0.9.1

package/dist/workers/email-otp.worker.js

@@ -17,7 +17,8 @@ var WALLET_EMAIL_OTP_ACTIONS = {
   registration: "wallet_email_otp_registration",
   recoveryBootstrap: "wallet_email_otp_recovery_bootstrap",
   unseal: "wallet_email_otp_unseal",
-  deviceLink: "wallet_email_otp_device_link"
+  deviceLink: "wallet_email_otp_device_link",
+  relocation: "wallet_email_otp_relocation"
 };
 var WALLET_EMAIL_OTP_EXPORT_OPERATION = "export_key";
 var WALLET_EMAIL_OTP_UNLOCK_OPERATION = "wallet_unlock";
@@ -1210,6 +1211,60 @@ function parseWalletCustodyEvmFamilyActivationCompletion(value) {
     ecdsaPublicFacts: parseWalletCustodyEvmFamilyPublicFacts(Reflect.get(value, "ecdsaPublicFacts"))
   };
 }
+// src/core/rpcClients/relayer/relayerHttp.ts
+function normalizeRelayerBaseUrl(value, options = { trim: true }) {
+  const raw = String(value ?? "");
+  return stripTrailingSlashes(options.trim ? raw.trim() : raw);
+}
+function buildBearerAuthorizationHeader(args) {
+  const token = String(args.token ?? "").trim();
+  if (!token)
+    throw new Error(args.missingMessage);
+  return { Authorization: `Bearer ${token}` };
+}
+function buildRelayerJsonPostRequestInit(args) {
+  return {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...args.headers || {}
+    },
+    credentials: "omit",
+    body: args.bodyJson ?? JSON.stringify(args.body)
+  };
+}
+function buildWalletSessionAuthorizationHeaders(credential) {
+  const headers = buildBearerAuthorizationHeader({
+    token: credential.token,
+    missingMessage: "Wallet Session token is required"
+  });
+  return { ...headers, ...buildWalletHomeRoutingHeaders(credential.home) };
+}
+function buildWalletHomeRoutingHeaders(home) {
+  switch (home.kind) {
+    case "direct":
+      return {};
+    case "regional":
+      return { "X-Seams-Wallet-Region": home.region };
+  }
+}
+async function fetchWithWalletHomeDiscovery(request) {
+  const response = await fetch(request.clone());
+  if (response.status !== 409 || !request.headers.has("X-Seams-Wallet-Region"))
+    return response;
+  let body;
+  try {
+    body = await response.clone().json();
+  } catch {
+    return response;
+  }
+  if (!isPlainObject(body) || body.code !== "wallet_home_discovery_required")
+    return response;
+  const headers = new Headers(request.headers);
+  headers.delete("X-Seams-Wallet-Region");
+  return fetch(new Request(request, { headers }));
+}
+
 // ../../crates/router-ab-ed25519-yao-client/pkg/router_ab_ed25519_yao_client.js
 class WasmActivatedClientV1 {
   static __wrap(ptr) {
@@ -3375,6 +3430,7 @@ function parseHttpTransportConfig(config) {
   }
   return {
     routerOrigin: origin.origin,
+    routing: config.routing,
     authorization: config.authorization,
     fetch: config.fetch,
     traceContext: resolveHttpTraceContext(config.traceContext)
@@ -3406,9 +3462,11 @@ async function parseHttpResponse(response) {
     const serverTiming = rawServerTiming || resourceServerTiming(response.url);
     return { ok: true, value, ...serverTiming ? { serverTiming } : {} };
   }
+  const code = asRecord(value)?.code;
   return {
     ok: false,
-    message: JSON.stringify(value)
+    message: JSON.stringify(value),
+    ...typeof code === "string" ? { code } : {}
   };
 }
 function resourceServerTiming(responseUrl) {
@@ -3458,6 +3516,7 @@ class RouterAbEd25519YaoHttpActivationTransportV1 {
       response = await this.config.fetch.call(globalThis, new URL(request.path, this.config.routerOrigin), {
         method: "POST",
         headers: {
+          ...yaoRoutingHeaders(this.config.routing),
           ...bearerAuthorization ? { authorization: bearerAuthorization } : {},
           ...recoveryChallengeId ? {
             [ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1]: recoveryChallengeId
@@ -3783,6 +3842,17 @@ class RouterAbEd25519YaoClientV1 {
     }
   }
 }
+function yaoRoutingHeaders(routing) {
+  switch (routing.kind) {
+    case "discovery":
+      return {};
+    case "direct":
+    case "regional":
+      return buildWalletHomeRoutingHeaders(routing);
+    default:
+      return assertNever(routing);
+  }
+}
 
 // src/core/signingEngine/walletCustody/openCustodyCache.ts
 function walletCustodyCacheEnvelopeFromRecordV1(envelope) {
@@ -4065,6 +4135,20 @@ function wireObject(shape, refine) {
   };
   return Object.assign(parse, { shape });
 }
+function wireUnion(tag, variants) {
+  const byTag = new Map;
+  for (const variant of variants) {
+    for (const literal of variant.shape[tag].literals)
+      byTag.set(literal, variant);
+  }
+  return (raw, label) => {
+    const record = requireRecord(raw, label);
+    const variant = byTag.get(record[tag]);
+    if (!variant)
+      throw new Error(`${label}.${tag} is invalid`);
+    return variant(record, label);
+  };
+}
 function wireResult(parse) {
   return (raw, label) => {
     const result = parse(raw);
@@ -4263,9 +4347,18 @@ function parseNonNegativeSafeInteger(raw, label) {
 }
 
 // ../shared-ts/src/device-linking/activeWalletSession.ts
+var walletSessionHome = wireUnion("kind", [
+  wireObject({ kind: wireLiteral("direct") }),
+  wireObject({ kind: wireLiteral("regional"), region: wireLiteral("US", "WEUR", "APAC", "OC") })
+]);
+function parseWalletSessionHome(raw) {
+  return walletSessionHome(raw, "Wallet Session home");
+}
 function walletSessionOperationCredentialV1() {
   return wireObject({
     kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+    ownershipGeneration: parseNonNegativeSafeInteger,
+    home: parseWalletSessionHome,
     token: (raw, label) => {
       if (typeof raw !== "string" || raw.length > 8192)
         throw new Error(`${label} is invalid`);
@@ -4273,6 +4366,9 @@ function walletSessionOperationCredentialV1() {
     },
     walletSessionId: keyLabeled(walletSessionId)
   }, (credential, label) => {
+    if (credential.ownershipGeneration === 0) {
+      throw new Error(`${label} ownership generation must be positive`);
+    }
     if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) {
       throw new Error(`${label} opaque token is invalid`);
     }
@@ -6264,6 +6360,12 @@ function buildEmailOtpSigningSessionAuthLane(args) {
 }
 function buildEmailOtpRoutePlan(args) {
   switch (args.routeFamily) {
+    case "operation_step_up":
+      return {
+        routeFamily: args.routeFamily,
+        operation: args.operation,
+        operationCredential: args.operationCredential
+      };
     case "registration":
       if (args.operation !== WALLET_EMAIL_OTP_REGISTRATION_OPERATION) {
         throw new Error("Email OTP registration routes require registration operation");
@@ -6283,7 +6385,7 @@ function buildEmailOtpRoutePlan(args) {
   throw new Error("Unsupported Email OTP route family");
 }
 function emailOtpRoutePath(plan, action) {
-  if (plan.routeFamily === "signing_session") {
+  if (plan.routeFamily === "signing_session" || plan.routeFamily === "operation_step_up") {
     if (action === "challenge")
       return "/wallet/email-otp/challenge";
   }
@@ -6306,13 +6408,22 @@ function normalizeEmailOtpRoutePlan(value) {
     return;
   const input = value;
   const routeFamily = nonEmptyString2(input.routeFamily);
-  if (!["login", "registration", "signing_session"].includes(routeFamily))
+  if (!["login", "registration", "signing_session", "operation_step_up"].includes(routeFamily))
     return;
   const operation = nonEmptyString2(input.operation);
   if (!isWalletEmailOtpLoginOperation(operation) && operation !== WALLET_EMAIL_OTP_REGISTRATION_OPERATION) {
     return;
   }
   try {
+    if (routeFamily === "operation_step_up") {
+      if (operation !== WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION)
+        return;
+      return buildEmailOtpRoutePlan({
+        routeFamily,
+        operation,
+        operationCredential: parseWalletSessionOperationCredentialV1(input.operationCredential)
+      });
+    }
     if (routeFamily === "login") {
       if (!isWalletEmailOtpLoginOperation(operation))
         return;
@@ -6401,6 +6512,9 @@ function readRoutePlan(value, label) {
     case "registration":
       rejectUnknownEmailOtpYaoFields(record, ["routeFamily", "operation"], `${label}.routePlan`);
       break;
+    case "operation_step_up":
+      rejectUnknownEmailOtpYaoFields(record, ["routeFamily", "operation", "operationCredential"], `${label}.routePlan`);
+      break;
     case "signing_session":
       rejectUnknownEmailOtpYaoFields(record, ["routeFamily", "operation", "authLane"], `${label}.routePlan`);
       parseEmailOtpWorkerAuthLane(record.authLane, label);
@@ -7976,7 +8090,7 @@ function generateRandomSecret32() {
   }
   return cryptoApi.getRandomValues(new Uint8Array(32));
 }
-var evmCryptoWasmUrl = resolveWasmUrl("evm_crypto.wasm", "Email OTP");
+var evmCryptoWasmUrl = resolveWasmUrl("evm_crypto_bg.wasm", "Email OTP");
 var emailOtpRuntimeWasmUrl = resolveWasmUrl("email_otp_runtime_bg.wasm", "Email OTP Runtime");
 var walletCustodyCeremonyWasmUrl = resolveWasmUrl("wallet_custody_ceremony_bg.wasm", "Email OTP Wallet Custody");
 var evmCryptoInitPromise = null;
@@ -7987,6 +8101,18 @@ function resetEmailOtpYaoClientInitOnFailure(error) {
   emailOtpYaoClientInitPromise = null;
   throw error;
 }
+function resetEvmCryptoInitOnFailure(error) {
+  evmCryptoInitPromise = null;
+  throw error;
+}
+function resetEmailOtpRuntimeInitOnFailure(error) {
+  emailOtpRuntimeInitPromise = null;
+  throw error;
+}
+function resetWalletCustodyCeremonyInitOnFailure(error) {
+  walletCustodyCeremonyInitPromise = null;
+  throw error;
+}
 function getEmailOtpYaoClient() {
   if (!emailOtpYaoClientInitPromise) {
     emailOtpYaoClientInitPromise = RouterAbEd25519YaoClientV1.initializeBundled().catch(resetEmailOtpYaoClientInitOnFailure);
@@ -7996,39 +8122,33 @@ function getEmailOtpYaoClient() {
 async function ensureEvmCryptoWasm() {
   if (evmCryptoInitPromise)
     return evmCryptoInitPromise;
-  evmCryptoInitPromise = (async () => {
-    await initializeWasm({
-      workerName: "Email OTP",
-      wasmUrl: evmCryptoWasmUrl,
-      initFunction: __wbg_init2,
-      validateFunction: () => init_evm_crypto()
-    });
-  })();
+  evmCryptoInitPromise = initializeWasm({
+    workerName: "Email OTP",
+    wasmUrl: evmCryptoWasmUrl,
+    initFunction: __wbg_init2,
+    validateFunction: init_evm_crypto
+  }).catch(resetEvmCryptoInitOnFailure);
   return evmCryptoInitPromise;
 }
 async function ensureEmailOtpRuntimeWasm() {
   if (emailOtpRuntimeInitPromise)
     return emailOtpRuntimeInitPromise;
-  emailOtpRuntimeInitPromise = (async () => {
-    await initializeWasm({
-      workerName: "Email OTP Runtime",
-      wasmUrl: emailOtpRuntimeWasmUrl,
-      initFunction: __wbg_init3,
-      validateFunction: () => init_email_otp_runtime()
-    });
-  })();
+  emailOtpRuntimeInitPromise = initializeWasm({
+    workerName: "Email OTP Runtime",
+    wasmUrl: emailOtpRuntimeWasmUrl,
+    initFunction: __wbg_init3,
+    validateFunction: init_email_otp_runtime
+  }).catch(resetEmailOtpRuntimeInitOnFailure);
   return emailOtpRuntimeInitPromise;
 }
 async function ensureWalletCustodyCeremonyWasm() {
   if (walletCustodyCeremonyInitPromise)
     return walletCustodyCeremonyInitPromise;
-  walletCustodyCeremonyInitPromise = (async () => {
-    await initializeWasm({
-      workerName: "Email OTP Wallet Custody",
-      wasmUrl: walletCustodyCeremonyWasmUrl,
-      initFunction: wallet_custody_ceremony_default
-    });
-  })();
+  walletCustodyCeremonyInitPromise = initializeWasm({
+    workerName: "Email OTP Wallet Custody",
+    wasmUrl: walletCustodyCeremonyWasmUrl,
+    initFunction: wallet_custody_ceremony_default
+  }).catch(resetWalletCustodyCeremonyInitOnFailure);
   return walletCustodyCeremonyInitPromise;
 }
 async function deriveEmailOtpUnlockAuthSeedInWorker(args) {
@@ -8896,28 +9016,19 @@ function parseEmailOtpVerifiedAuthorityProjection(raw) {
 }
 
 // src/core/signingEngine/workerManager/workers/email-otp/fetch.ts
-function requireObjectJson(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} returned invalid JSON`);
-  }
-  return value;
-}
-function buildSessionHeaders(args) {
-  const headers = { "Content-Type": "application/json" };
-  const token = String(args.sessionAuth?.token || "").trim();
-  if (token)
-    headers.Authorization = `Bearer ${token}`;
-  return headers;
-}
 async function postEmailOtpJson(args) {
   const url = joinNormalizedUrl(args.relayUrl, args.route);
   try {
-    const response = await fetch(url, {
+    const request = new Request(url, {
       method: "POST",
-      headers: buildSessionHeaders({ sessionAuth: args.sessionAuth }),
+      headers: {
+        "Content-Type": "application/json",
+        ...args.sessionAuth ? buildWalletSessionAuthorizationHeaders(args.sessionAuth) : {}
+      },
       credentials: args.sessionAuth ? "omit" : "include",
       body: JSON.stringify(args.body)
     });
+    const response = args.sessionAuth ? await fetchWithWalletHomeDiscovery(request) : await fetch(request);
     const text = await response.text();
     let json = null;
     try {
@@ -8925,7 +9036,7 @@ async function postEmailOtpJson(args) {
     } catch {
       throw new Error(`${url} returned non-JSON response (HTTP ${response.status})`);
     }
-    const objectJson = requireObjectJson(json, url);
+    const objectJson = requireRecord(json, url);
     if (!response.ok || objectJson.ok === false) {
       const message = typeof objectJson.message === "string" && objectJson.message.trim() || `${url} failed (HTTP ${response.status})`;
       throw new Error(message);
@@ -8966,6 +9077,8 @@ function assertEmailOtpChallengeAction(args) {
   }
 }
 function emailOtpRouteSessionAuth(routePlan) {
+  if (routePlan.routeFamily === "operation_step_up")
+    return routePlan.operationCredential;
   return routePlan.routeFamily === "signing_session" ? routePlan.authLane.operationCredential : undefined;
 }
 async function postEmailOtpChallenge(args) {
@@ -9058,32 +9171,11 @@ async function releaseEmailOtpFactorSecret(args) {
   }
 }
 
-// src/core/rpcClients/relayer/relayerHttp.ts
-function normalizeRelayerBaseUrl(value, options = { trim: true }) {
-  const raw = String(value ?? "");
-  return stripTrailingSlashes(options.trim ? raw.trim() : raw);
-}
-function buildBearerAuthorizationHeader(args) {
-  const token = String(args.token ?? "").trim();
-  if (!token)
-    throw new Error(args.missingMessage);
-  return { Authorization: `Bearer ${token}` };
-}
-function buildRelayerJsonPostRequestInit(args) {
-  return {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      ...args.headers || {}
-    },
-    credentials: "omit",
-    body: args.bodyJson ?? JSON.stringify(args.body)
-  };
-}
-
 // src/core/rpcClients/relayer/walletSessionAuthorizationStatus.ts
 var EXACT_WALLET_SESSION_STATUS_PATH = "/wallet/session/status";
 var defaultStatusFetch = (input, init) => globalThis.fetch(input, init);
+var observationsByFetch = new WeakMap;
+var registrationSessions = new Map;
 var OBSERVED_FIELDS = [
   "ok",
   "status",
@@ -9225,10 +9317,7 @@ class RelayerExactWalletSessionStatusPort {
           walletSessionId: input.walletSessionId,
           quotaId: input.quotaId
         },
-        headers: buildBearerAuthorizationHeader({
-          token: this.operationCredential.token,
-          missingMessage: "Wallet Session token is required for Wallet Session status"
-        })
+        headers: buildWalletSessionAuthorizationHeaders(this.operationCredential)
       }),
       credentials: "omit"
     });
@@ -11218,6 +11307,7 @@ async function exportEmailOtpEd25519YaoSeed(args) {
       },
       resolveCustodyEnvelope: args.resolveCustodyEnvelope,
       transport: new RouterAbEd25519YaoHttpActivationTransportV1({
+        routing: { kind: "discovery" },
         routerOrigin: new URL(args.relayUrl).origin,
         authorization: { kind: "cookies" },
         fetch: globalThis.fetch.bind(globalThis)
@@ -11646,10 +11736,10 @@ async function issueEd25519OperationStepUpAuthorization(args) {
   const materialRecovery = buildEd25519OperationStepUpMaterialRecoveryRequest(args);
   const bearer = args.credential.kind === "wallet_session_opaque" ? {
     token: args.credential.walletSessionToken,
-    missingMessage: "walletSessionToken is required"
+    home: args.credential.home
   } : null;
   const requestInit = buildRelayerJsonPostRequestInit({
-    ...bearer ? { headers: buildBearerAuthorizationHeader(bearer) } : {},
+    ...bearer ? { headers: buildWalletSessionAuthorizationHeaders(bearer) } : {},
     body: {
       kind: "router_ab_ed25519_yao_operation_step_up_grant_v1",
       normalSigningRequest: args.normalSigningRequest,
@@ -11795,7 +11885,8 @@ async function rehydrateEmailOtpEd25519YaoOperationMaterial(args) {
   }
   const credential = {
     kind: "wallet_session_opaque",
-    walletSessionToken: operationCredential.token
+    walletSessionToken: operationCredential.token,
+    home: operationCredential.home
   };
   const material = {
     kind: "ed25519_yao_operation_recovery",
@@ -11907,36 +11998,35 @@ async function rehydrateActiveEmailOtpEd25519YaoSessionMaterial(args) {
       enrollmentId: released.enrollmentId,
       enrollmentSealKeyVersion: released.enrollmentSealKeyVersion,
       clientSecret32: factorSecret32,
-      material: {
-        kind: "wallet_unlock_capabilities",
-        ecdsa: args.ecdsa,
-        ed25519Yao: {
-          providerSubject: providerSubjectId,
-          nearAccountId: args.nearAccountId,
-          expectedOperationalPublicKey: args.expectedOperationalPublicKey,
-          expectedThresholdSessionId: args.expectedThresholdSessionId,
-          walletCustodyEd25519Material: args.walletCustodyEd25519Material,
-          recovery: {
-            kind: ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1,
-            signerSlot: args.signerSlot,
-            remainingUses: args.remainingUses,
-            orgId: args.orgId
-          }
-        }
-      },
+      material: activeEmailOtpNearRestoreMaterial(args),
       sessionAuth
     });
     factorSecret32 = null;
-    if (unlocked.kind !== "wallet_unlock_capabilities" || unlocked.ed25519Yao.kind !== "capability") {
-      throw new Error("Active Email OTP Wallet Session did not restore wallet capabilities");
+    switch (unlocked.kind) {
+      case "ed25519_yao_capability":
+        if (args.ecdsa.kind !== "absent")
+          throw new Error("Combined restore omitted ECDSA activation");
+        return {
+          activeClientHandle: unlocked.activeClientHandle,
+          metadata: unlocked.metadata,
+          bootstrap: unlocked.ed25519YaoCapability,
+          ecdsa: { kind: "absent" },
+          walletSessionAuthorization: unlocked.walletSessionAuthorization
+        };
+      case "wallet_unlock_capabilities":
+        if (args.ecdsa.kind !== "required" || unlocked.ed25519Yao.kind !== "capability") {
+          throw new Error("Active Email OTP Wallet Session did not restore selected capabilities");
+        }
+        return {
+          activeClientHandle: unlocked.ed25519Yao.activeClientHandle,
+          metadata: unlocked.ed25519Yao.metadata,
+          bootstrap: unlocked.ed25519Yao.bootstrap,
+          ecdsa: { kind: "activated", session: unlocked.ecdsa.session },
+          walletSessionAuthorization: unlocked.walletSessionAuthorization
+        };
+      default:
+        throw new Error("Active Email OTP Wallet Session did not restore selected capabilities");
     }
-    return {
-      activeClientHandle: unlocked.ed25519Yao.activeClientHandle,
-      metadata: unlocked.ed25519Yao.metadata,
-      bootstrap: unlocked.ed25519Yao.bootstrap,
-      ecdsaSession: unlocked.ecdsa.session,
-      walletSessionAuthorization: unlocked.walletSessionAuthorization
-    };
   } finally {
     zeroizeBytes(factorSecret32);
   }
@@ -11958,6 +12048,46 @@ async function rotateEmailOtpWalletRecoverySet(args) {
     zeroizeBytes(recovered.clientSecret32);
   }
 }
+function activeEmailOtpNearRestoreMaterial(args) {
+  const recovery = {
+    kind: ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1,
+    signerSlot: args.signerSlot,
+    remainingUses: args.remainingUses,
+    orgId: args.orgId
+  };
+  switch (args.ecdsa.kind) {
+    case "absent":
+      return {
+        kind: "ed25519_yao_recovery",
+        ed25519YaoRecovery: recovery,
+        providerSubject: args.providerSubjectId,
+        nearAccountId: args.nearAccountId,
+        expectedOperationalPublicKey: args.expectedOperationalPublicKey,
+        expectedThresholdSessionId: args.expectedThresholdSessionId,
+        walletCustodyEd25519Material: args.walletCustodyEd25519Material
+      };
+    case "required":
+      return {
+        kind: "wallet_unlock_capabilities",
+        ecdsa: {
+          sessionHandleBinding: args.ecdsa.sessionHandleBinding,
+          runtimePolicyScope: args.ecdsa.runtimePolicyScope,
+          sessionPolicy: args.ecdsa.sessionPolicy
+        },
+        ed25519Yao: {
+          recovery,
+          providerSubject: args.providerSubjectId,
+          nearAccountId: args.nearAccountId,
+          expectedOperationalPublicKey: args.expectedOperationalPublicKey,
+          expectedThresholdSessionId: args.expectedThresholdSessionId,
+          walletCustodyEd25519Material: args.walletCustodyEd25519Material
+        }
+      };
+    default:
+      args.ecdsa;
+      throw new Error("Unsupported Email OTP restore selection");
+  }
+}
 
 // src/core/signingEngine/workerManager/workers/email-otp/enrollment.ts
 var EMAIL_OTP_UNLOCK_KEY_VERSION = "email-otp-unlock-v1";
@@ -11970,34 +12100,19 @@ function emailOtpWalletRegistrationEcdsaHandleResult(request) {
   }
   return { kind: "not_requested" };
 }
-async function completeEmailOtpEnrollmentFromSecret32(args) {
+async function prepareEmailOtpEnrollmentFromSecret32(args) {
   await ensureEvmCryptoWasm();
   const runtime = await getShamir3PassRuntime();
   const relayUrl = readString(args.relayUrl, "relayUrl");
   const walletId = readString(args.walletId, "walletId");
   const userId = resolveEmailOtpAuthSubjectId({ userId: args.userId });
   readSigningSessionSealGroupId(args.groupId);
-  const otpCode = args.skipServerFinalize ? "" : readString(args.otpCode, "otpCode");
   const keyHandle = readString((await runtime.createClientKeyHandle({ groupId: SIGNING_SESSION_SEAL_GROUP_ID })).keyHandle, "keyHandle");
   let clientSecret32 = args.clientSecret32 ? Uint8Array.from(args.clientSecret32) : generateRandomSecret32();
   let unlockPrivateKey32 = null;
   let unlockPublicKey33 = null;
   try {
     const sessionAuth = emailOtpRouteSessionAuth(args.routePlan);
-    let challengeId = toOptionalTrimmedNonEmptyString(args.challengeId);
-    if (!challengeId && !args.skipServerFinalize) {
-      const challenge = await postEmailOtpChallenge({
-        relayUrl,
-        routePlan: args.routePlan,
-        body: {
-          walletId,
-          otpChannel: EMAIL_OTP_CHANNEL
-        },
-        expectedAction: WALLET_EMAIL_OTP_ACTIONS.registration,
-        label: "Email OTP registration challenge"
-      });
-      challengeId = readString(challenge.challenge?.challengeId, "challengeId");
-    }
     const wrappedCiphertext = await addClientSealFromBytes({
       runtime,
       keyHandle,
@@ -12025,34 +12140,9 @@ async function completeEmailOtpEnrollmentFromSecret32(args) {
     unlockPublicKey33 = secp256k1_private_key_32_to_public_key_33(unlockPrivateKey32);
     const clientUnlockPublicKeyB64u = base64UrlEncode(unlockPublicKey33);
     const enrollmentId = emailOtpDeviceEnrollmentId(walletId, userId);
-    if (!args.skipServerFinalize) {
-      const googleEmailOtpRegistrationAttemptId = toOptionalTrimmedNonEmptyString(args.googleEmailOtpRegistrationAttemptId);
-      await postEmailOtpJson({
-        relayUrl,
-        route: emailOtpRoutePath(args.routePlan, "finalize"),
-        ...sessionAuth ? { sessionAuth } : {},
-        body: {
-          walletId,
-          challengeId,
-          otpCode,
-          otpChannel: EMAIL_OTP_CHANNEL,
-          enrollmentSealKeyVersion,
-          serverSealedFactorCiphertextB64u,
-          clientUnlockPublicKeyB64u,
-          unlockKeyVersion: EMAIL_OTP_UNLOCK_KEY_VERSION,
-          ...googleEmailOtpRegistrationAttemptId ? { googleEmailOtpRegistrationAttemptId } : {}
-        }
-      });
-      args.onProgress?.("otp.verify.succeeded");
-    }
     args.onProgress?.("signer.email_otp.enroll.started");
     args.onProgress?.("signer.email_otp.enroll.succeeded");
-    const returnedClientSecret32 = args.returnClientSecret32 && clientSecret32 ? clientSecret32 : null;
-    if (returnedClientSecret32) {
-      clientSecret32 = null;
-    }
     return {
-      challengeId: challengeId || "",
       otpChannel: EMAIL_OTP_CHANNEL,
       enrollmentId,
       enrollmentSealKeyVersion,
@@ -12064,8 +12154,7 @@ async function completeEmailOtpEnrollmentFromSecret32(args) {
         serverSealedFactorCiphertextB64u,
         clientUnlockPublicKeyB64u,
         unlockKeyVersion: EMAIL_OTP_UNLOCK_KEY_VERSION
-      },
-      ...returnedClientSecret32 ? { clientSecret32: returnedClientSecret32 } : {}
+      }
     };
   } finally {
     zeroizeBytes(clientSecret32);
@@ -12080,16 +12169,6 @@ async function completeEmailOtpEnrollmentFromSecret32(args) {
 function enrollmentClientSecret32(value) {
   return value instanceof ArrayBuffer ? { clientSecret32: requireFixed32ArrayBuffer(value, "clientSecret32") } : {};
 }
-function emailOtpEnrollmentFacts(result) {
-  return {
-    otpChannel: result.otpChannel,
-    enrollmentId: result.enrollmentId,
-    enrollmentSealKeyVersion: result.enrollmentSealKeyVersion,
-    serverSealedFactorCiphertextB64u: result.serverSealedFactorCiphertextB64u,
-    clientUnlockPublicKeyB64u: result.clientUnlockPublicKeyB64u,
-    unlockKeyVersion: result.unlockKeyVersion
-  };
-}
 
 // src/core/signingEngine/workerManager/workers/email-otp/operationRequestParsing.ts
 function parseEmailOtpOperationDigest(value, label) {
@@ -12422,39 +12501,6 @@ function parseEmailOtpWorkerRequest(raw) {
         }
       };
     }
-    case "enrollEmailOtpWallet": {
-      rejectUnknownEmailOtpYaoFields(payload, [
-        "relayUrl",
-        "walletId",
-        "userId",
-        "challengeId",
-        "otpCode",
-        "groupId",
-        "routePlan",
-        "googleEmailOtpRegistrationAttemptId",
-        "otpChannel",
-        "clientSecret32"
-      ], type);
-      const otpChannel = parseOptionalEmailOtpChannel(payload.otpChannel, `${type}.otpChannel`);
-      return {
-        id,
-        type,
-        payload: {
-          relayUrl: readString(payload.relayUrl, "relayUrl"),
-          walletId: readString(payload.walletId, "walletId"),
-          userId: readString(payload.userId, "userId"),
-          ...toOptionalTrimmedNonEmptyString(payload.challengeId) ? { challengeId: toOptionalTrimmedNonEmptyString(payload.challengeId) } : {},
-          otpCode: readString(payload.otpCode, "otpCode"),
-          groupId: readString(payload.groupId, "groupId"),
-          routePlan: readRegistrationRoutePlan(payload.routePlan, type),
-          ...toOptionalTrimmedNonEmptyString(payload.googleEmailOtpRegistrationAttemptId) ? {
-            googleEmailOtpRegistrationAttemptId: toOptionalTrimmedNonEmptyString(payload.googleEmailOtpRegistrationAttemptId)
-          } : {},
-          ...otpChannel === undefined ? {} : { otpChannel },
-          ...payload.clientSecret32 instanceof ArrayBuffer ? { clientSecret32: payload.clientSecret32 } : {}
-        }
-      };
-    }
     case "prepareEmailOtpRegistrationEnrollmentMaterial": {
       rejectUnknownEmailOtpYaoFields(payload, [
         "relayUrl",
@@ -12723,15 +12769,7 @@ function parseEmailOtpWorkerRequest(raw) {
         "ecdsa",
         "walletCustodyEd25519Material"
       ], type);
-      const ecdsa = asRecord(payload.ecdsa);
-      if (!ecdsa) {
-        throw new Error("Active Email OTP restore requires exact ECDSA session input");
-      }
-      rejectUnknownEmailOtpYaoFields(ecdsa, ["sessionHandleBinding", "runtimePolicyScope", "sessionPolicy"], `${type}.ecdsa`);
-      const ecdsaBinding = parseOptionalWorkerEcdsaSessionBootstrapHandleBinding(ecdsa.sessionHandleBinding);
-      if (!ecdsaBinding || ecdsaBinding.operation !== "wallet_unlock") {
-        throw new Error("Active Email OTP restore requires wallet-unlock ECDSA binding");
-      }
+      const ecdsa = parseNearRestoreEcdsa(payload.ecdsa);
       const material = parseWalletCustodyEd25519MaterialRequest(payload.walletCustodyEd25519Material);
       if (material.kind !== "found") {
         throw new Error("Active Email OTP restore requires wallet custody Ed25519 material");
@@ -12751,11 +12789,7 @@ function parseEmailOtpWorkerRequest(raw) {
           expectedOperationalPublicKey: readString(payload.expectedOperationalPublicKey, "expectedOperationalPublicKey"),
           expectedThresholdSessionId: readThresholdEd25519SessionId(payload.expectedThresholdSessionId, "expectedThresholdSessionId"),
           operationCredential: parseWalletSessionOperationCredentialV1(payload.operationCredential),
-          ecdsa: {
-            sessionHandleBinding: { ...ecdsaBinding, operation: "wallet_unlock" },
-            runtimePolicyScope: parseWorkerRuntimePolicyScope(ecdsa.runtimePolicyScope, "Active Email OTP restore"),
-            sessionPolicy: parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(ecdsa.sessionPolicy)
-          },
+          ecdsa,
           walletCustodyEd25519Material: material
         }
       };
@@ -12828,6 +12862,31 @@ function parseEmailOtpWorkerRequest(raw) {
       return null;
   }
 }
+function parseNearRestoreEcdsa(value) {
+  const ecdsa = asRecord(value);
+  if (!ecdsa)
+    throw new Error("Active Email OTP restore requires an ECDSA selection");
+  switch (ecdsa.kind) {
+    case "absent":
+      rejectUnknownEmailOtpYaoFields(ecdsa, ["kind"], "NEAR-only Email OTP restore");
+      return { kind: "absent" };
+    case "required": {
+      rejectUnknownEmailOtpYaoFields(ecdsa, ["kind", "sessionHandleBinding", "runtimePolicyScope", "sessionPolicy"], "Combined Email OTP restore");
+      const binding = parseOptionalWorkerEcdsaSessionBootstrapHandleBinding(ecdsa.sessionHandleBinding);
+      if (!binding || binding.operation !== "wallet_unlock") {
+        throw new Error("Active Email OTP restore requires wallet-unlock ECDSA binding");
+      }
+      return {
+        kind: "required",
+        sessionHandleBinding: binding,
+        runtimePolicyScope: parseWorkerRuntimePolicyScope(ecdsa.runtimePolicyScope, "Active Email OTP restore"),
+        sessionPolicy: parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1(ecdsa.sessionPolicy)
+      };
+    }
+    default:
+      throw new Error("Active Email OTP restore has an invalid ECDSA selection");
+  }
+}
 
 // src/core/signingEngine/workerManager/workers/email-otp/dispatch.ts
 function postToMainThread(message, transfer) {
@@ -12929,55 +12988,26 @@ async function handleEmailOtpWorkerMessage(event) {
         postToMainThread({ id: msg.id, ok: true, result });
         return;
       }
-      case "enrollEmailOtpWallet": {
-        const routePlan = readRoutePlan(msg.payload.routePlan, "enrollEmailOtpWallet");
-        const result = await completeEmailOtpEnrollmentFromSecret32({
+      case "prepareEmailOtpRegistrationEnrollmentMaterial": {
+        const routePlan = readRoutePlan(msg.payload.routePlan, "prepareEmailOtpRegistrationEnrollmentMaterial");
+        const result = await prepareEmailOtpEnrollmentFromSecret32({
           relayUrl: readString(msg.payload.relayUrl, "relayUrl"),
           walletId: readString(msg.payload.walletId, "walletId"),
           userId: msg.payload.userId,
-          challengeId: msg.payload.challengeId,
-          otpCode: readString(msg.payload.otpCode, "otpCode"),
           groupId: readString(msg.payload.groupId, "groupId"),
           routePlan,
-          googleEmailOtpRegistrationAttemptId: msg.payload.googleEmailOtpRegistrationAttemptId,
           onProgress: (code) => postEmailOtpWorkerProgress(msg.id, code),
           ...enrollmentClientSecret32(msg.payload.clientSecret32)
         });
+        const emailOtpSessionHandle = emailOtpWalletRegistrationEcdsaHandleResult(msg.payload.ecdsaSessionHandle);
         postToMainThread({
           id: msg.id,
           ok: true,
-          result: { challengeId: result.challengeId, ...emailOtpEnrollmentFacts(result) }
-        });
-        return;
-      }
-      case "prepareEmailOtpRegistrationEnrollmentMaterial": {
-        const routePlan = readRoutePlan(msg.payload.routePlan, "prepareEmailOtpRegistrationEnrollmentMaterial");
-        const result = await completeEmailOtpEnrollmentFromSecret32({
-          relayUrl: readString(msg.payload.relayUrl, "relayUrl"),
-          walletId: readString(msg.payload.walletId, "walletId"),
-          userId: msg.payload.userId,
-          groupId: readString(msg.payload.groupId, "groupId"),
-          routePlan,
-          returnClientSecret32: false,
-          skipServerFinalize: true,
-          onProgress: (code) => postEmailOtpWorkerProgress(msg.id, code),
-          ...enrollmentClientSecret32(msg.payload.clientSecret32)
+          result: {
+            ...result,
+            emailOtpSessionHandle
+          }
         });
-        try {
-          readString(msg.payload.walletId, "walletId");
-          const emailOtpSessionHandle = emailOtpWalletRegistrationEcdsaHandleResult(msg.payload.ecdsaSessionHandle);
-          postToMainThread({
-            id: msg.id,
-            ok: true,
-            result: {
-              ...emailOtpEnrollmentFacts(result),
-              emailOtpSessionHandle,
-              emailOtpEnrollment: result.emailOtpEnrollment
-            }
-          });
-        } finally {
-          zeroizeBytes(result.clientSecret32);
-        }
         return;
       }
       case "releaseWalletRecoveryEmailOtpFactor": {