In step 2 in https://wicg.github.io/WebOTP/#sctn-discover-from-external-source you seem to re-assign |options| to be the OTPCredentialRequestOptions inside the CredentialRequestOptions object, however later in that algorithm you still use |options| to refer to the outer CredentialRequestOptions object. You should probably not use the same name for two different objects/variables.
In step 2 in https://wicg.github.io/WebOTP/#sctn-discover-from-external-source you seem to re-assign |options| to be the OTPCredentialRequestOptions inside the CredentialRequestOptions object, however later in that algorithm you still use |options| to refer to the outer CredentialRequestOptions object. You should probably not use the same name for two different objects/variables.