@cef-ai/wallet-identity 1.0.0 → 1.1.0

package/dist/index.d.cts

@@ -7,12 +7,69 @@ interface Addresses {
     evm: string;
 }
 type Chain = 'cere' | 'solana' | 'evm';
+/**
+ * A transferable snapshot of the current session — the raw chain-key material
+ * plus the addresses it yields and an absolute expiry. This is the payload the
+ * register-popup → iframe handoff moves across the same-origin
+ * `BroadcastChannel('scp-wallet-v2')` (see embed-sdk's `BroadcastSessionShare`).
+ *
+ * SECURITY: unlike `VaultSnapshot`, this DOES carry the raw seeds. It exists
+ * only so a same-origin sibling surface (the persistent iframe) can adopt a
+ * session a punched-out popup just created — Safari blocks the WebAuthn
+ * `create()` ceremony in a cross-origin iframe (Task 6), so the popup runs the
+ * ceremony and hands its result back. It must NEVER cross an origin boundary or
+ * reach a host page. Spec §3.6 invariant 1 (keys never leave the wallet origin)
+ * still holds: the channel is same-origin and wallet-only.
+ *
+ * The field shape intentionally matches embed-sdk's `BroadcastSession`. It is
+ * declared here (not imported from embed-sdk) to avoid a circular package
+ * dependency — embed-sdk already depends on this package.
+ */
+interface IdentitySession {
+    /** Ed25519 32-byte secret key seed; Cere + Solana signing. */
+    edSeed: Uint8Array;
+    /** secp256k1 32-byte secret key; EVM signing. */
+    secpKey: Uint8Array;
+    addresses: Addresses;
+    /** Absolute Unix epoch ms when the session expires. */
+    expMs: number;
+}
+/**
+ * Same-origin session-handoff capability. Kept OFF the core `Identity`
+ * interface deliberately: it is an optional, wallet-origin-only concern (the
+ * register-popup → iframe handoff), and forcing every `Identity` implementation
+ * — including thin test doubles — to provide raw-key export/import would widen
+ * the security surface for no benefit. Concrete `IdentityImpl` implements it;
+ * SPA wiring feature-detects via `supportsSessionHandoff()`.
+ */
+interface SessionHandoff {
+    /**
+     * Export the current session for a same-origin handoff, or `null` when no
+     * live session exists (vault closed / expired / no captured keys). See
+     * `IdentitySession` for the security contract.
+     */
+    exportSession(): IdentitySession | null;
+    /**
+     * Adopt a session handed over from a same-origin sibling surface (e.g. the
+     * register popup). Rebuilds the derived keys from the transported seeds, opens
+     * the vault, and syncs public state — WITHOUT running a WebAuthn ceremony.
+     */
+    adoptSession(session: IdentitySession): void;
+}
+/**
+ * Narrow an `Identity` to one that supports same-origin session handoff.
+ * `IdentityImpl` returns true; thin test doubles return false and are simply
+ * skipped by the responder/requester wiring.
+ */
+declare function supportsSessionHandoff(identity: Identity): identity is Identity & SessionHandoff;
 interface Identity {
     readonly isAuthenticated: boolean;
     readonly addresses: Addresses | null;
     readonly credentialId: string | null;
     register(opts?: {
         label?: string;
+        name?: string;
+        email?: string;
     }): Promise<void>;
     login(): Promise<void>;
     logout(): void;
@@ -39,11 +96,12 @@ declare const PRF_INPUT_LABEL = "cere-wallet-prf-v1";
 /**
  * SHA-256("cere-wallet-prf-v1") — 32 bytes. Fed to WebAuthn `prf.eval.first`.
  *
- * Implementation note: `createHash` runs at module evaluation time. In the test
- * environment (Vitest on Node) this works natively via `node:crypto`. In the
- * browser this depends on a `node:crypto` polyfill — `vite-plugin-node-polyfills`
- * is wired in by Cycle 1 Task 8. A follow-up cycle should replace this expression
- * with a hard-coded `Uint8Array` literal to eliminate the polyfill dependency.
+ * Hard-coded as a byte literal so this module is browser-safe with NO
+ * `node:crypto` dependency — it is evaluated at module-load time, and relying on
+ * `createHash` there forced every browser consumer to wire a `node:crypto`
+ * polyfill (`vite-plugin-node-polyfills`). The literal is verified to equal
+ * `sha256(PRF_INPUT_LABEL)` in `constants.test.ts`, so the constant cannot drift
+ * silently. Rotating the label (`-v2`) means recomputing these bytes.
  */
 declare const PRF_INPUT_SEED: Uint8Array;
 /** Spec §3.2. Used as HKDF-SHA256 info to derive the secp256k1 32-byte secret. */
@@ -183,8 +241,18 @@ interface RegisterOptions {
     userHandle: Uint8Array;
     /** 32-byte PRF input (typically `PRF_INPUT_SEED`). */
     prfInput: Uint8Array;
-    /** Human-readable label for the credential. Currently a hint, not stored. */
+    /**
+     * Legacy single label. Used as a fallback for both `user.displayName` and
+     * `user.name` when `name`/`email` are not supplied. Prefer `name` + `email`.
+     */
     label?: string;
+    /** Friendly account name → WebAuthn `user.displayName` (e.g. "Alex Müller"). */
+    name?: string;
+    /**
+     * Account identifier → WebAuthn `user.name` (e.g. "alex@example.com"). This is
+     * the field most OS/browser passkey managers surface to distinguish credentials.
+     */
+    email?: string;
 }
 interface RegisterResult {
     credentialId: string;
@@ -340,12 +408,27 @@ interface IdentityImplOptions {
     apiClient: ApiClient;
     ceremony: CeremonyAdapter;
 }
-declare class IdentityImpl implements Identity {
+declare class IdentityImpl implements Identity, SessionHandoff {
     private readonly opts;
     private readonly vault;
     private cachedJwt;
     /** Server-returned credential ID (used as the public identity.credentialId). */
     private serverCredentialId;
+    /**
+     * Raw derived keys for the CURRENT session, captured at every `vault.set()`
+     * call site (register / login / adoptSession). The vault deliberately hides
+     * the seeds behind its closure (Spec §3.6 invariant 1); this field is the
+     * single, explicit, same-origin-only seam that lets `exportSession()` hand a
+     * live session to a sibling wallet-origin surface (the persistent iframe).
+     * Cleared on logout / cross-tab logout alongside the vault. Never serialised
+     * to storage and never sent to a host page.
+     */
+    private sessionKeys;
+    /**
+     * Absolute expiry (epoch ms) for `exportSession()`. Tracks the cached JWT
+     * expiry after register/login; set from the adopted session in adoptSession.
+     */
+    private sessionExpMs;
     private readonly _isAuthenticated;
     private readonly _addresses;
     private readonly _credentialId;
@@ -372,6 +455,8 @@ declare class IdentityImpl implements Identity {
     private syncPublicState;
     register(opts?: {
         label?: string;
+        name?: string;
+        email?: string;
     }): Promise<void>;
     login(): Promise<void>;
     logout(): void;
@@ -384,6 +469,24 @@ declare class IdentityImpl implements Identity {
      * side use — keys never reach the host. Spec §3.6 invariant 1.
      */
     getVault(): SessionVault;
+    /**
+     * Export the current session for a same-origin handoff (register popup →
+     * iframe). Returns `null` unless the vault is open, we captured the derived
+     * keys, and the session has not expired. The raw seeds ARE included — this is
+     * the deliberate, narrow seam described on `IdentitySession`; callers must
+     * only pass the result across the same-origin wallet BroadcastChannel.
+     */
+    exportSession(): IdentitySession | null;
+    /**
+     * Adopt a session handed over from a same-origin sibling surface. Rebuilds
+     * the `DerivedKeys` from the transported seeds (public keys are recomputed
+     * from the seeds; we do NOT re-run the HKDF step so the exact transported
+     * secpKey is preserved), opens the vault, and syncs public state — no
+     * ceremony. There is no credentialId in the handoff, so login() would need a
+     * fresh ceremony; but the session key is warm, so `sign`/`claim` (which use
+     * the vault directly, no JWT) work immediately.
+     */
+    adoptSession(session: IdentitySession): void;
     /**
      * Release the BroadcastChannel + cross-tab subscriber. Idempotent.
      *
@@ -440,4 +543,4 @@ declare class CrossTabSync {
     close(): void;
 }
 
-export { type Addresses, CERE_SS58_PREFIX, type CeremonyAdapter, type Chain, type CrossTabMessage, CrossTabSync, type DerivedKeys, EVM_HKDF_INFO, type Identity, IdentityImpl, type IdentityImplOptions, type InternalSign, type LoginOptions, type LoginResult, PRF_INPUT_LABEL, PRF_INPUT_SEED, type PrfSupportResult, type RegisterOptions, type RegisterResult, type SessionVault, SoftAuthenticator, type VaultSnapshot, WebAuthnCeremonyAdapter, type WebAuthnCeremonyAdapterOptions, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult };
+export { type Addresses, CERE_SS58_PREFIX, type CeremonyAdapter, type Chain, type CrossTabMessage, CrossTabSync, type DerivedKeys, EVM_HKDF_INFO, type Identity, IdentityImpl, type IdentityImplOptions, type IdentitySession, type InternalSign, type LoginOptions, type LoginResult, PRF_INPUT_LABEL, PRF_INPUT_SEED, type PrfSupportResult, type RegisterOptions, type RegisterResult, type SessionHandoff, type SessionVault, SoftAuthenticator, type VaultSnapshot, WebAuthnCeremonyAdapter, type WebAuthnCeremonyAdapterOptions, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult, supportsSessionHandoff };

package/dist/index.d.ts

@@ -7,12 +7,69 @@ interface Addresses {
     evm: string;
 }
 type Chain = 'cere' | 'solana' | 'evm';
+/**
+ * A transferable snapshot of the current session — the raw chain-key material
+ * plus the addresses it yields and an absolute expiry. This is the payload the
+ * register-popup → iframe handoff moves across the same-origin
+ * `BroadcastChannel('scp-wallet-v2')` (see embed-sdk's `BroadcastSessionShare`).
+ *
+ * SECURITY: unlike `VaultSnapshot`, this DOES carry the raw seeds. It exists
+ * only so a same-origin sibling surface (the persistent iframe) can adopt a
+ * session a punched-out popup just created — Safari blocks the WebAuthn
+ * `create()` ceremony in a cross-origin iframe (Task 6), so the popup runs the
+ * ceremony and hands its result back. It must NEVER cross an origin boundary or
+ * reach a host page. Spec §3.6 invariant 1 (keys never leave the wallet origin)
+ * still holds: the channel is same-origin and wallet-only.
+ *
+ * The field shape intentionally matches embed-sdk's `BroadcastSession`. It is
+ * declared here (not imported from embed-sdk) to avoid a circular package
+ * dependency — embed-sdk already depends on this package.
+ */
+interface IdentitySession {
+    /** Ed25519 32-byte secret key seed; Cere + Solana signing. */
+    edSeed: Uint8Array;
+    /** secp256k1 32-byte secret key; EVM signing. */
+    secpKey: Uint8Array;
+    addresses: Addresses;
+    /** Absolute Unix epoch ms when the session expires. */
+    expMs: number;
+}
+/**
+ * Same-origin session-handoff capability. Kept OFF the core `Identity`
+ * interface deliberately: it is an optional, wallet-origin-only concern (the
+ * register-popup → iframe handoff), and forcing every `Identity` implementation
+ * — including thin test doubles — to provide raw-key export/import would widen
+ * the security surface for no benefit. Concrete `IdentityImpl` implements it;
+ * SPA wiring feature-detects via `supportsSessionHandoff()`.
+ */
+interface SessionHandoff {
+    /**
+     * Export the current session for a same-origin handoff, or `null` when no
+     * live session exists (vault closed / expired / no captured keys). See
+     * `IdentitySession` for the security contract.
+     */
+    exportSession(): IdentitySession | null;
+    /**
+     * Adopt a session handed over from a same-origin sibling surface (e.g. the
+     * register popup). Rebuilds the derived keys from the transported seeds, opens
+     * the vault, and syncs public state — WITHOUT running a WebAuthn ceremony.
+     */
+    adoptSession(session: IdentitySession): void;
+}
+/**
+ * Narrow an `Identity` to one that supports same-origin session handoff.
+ * `IdentityImpl` returns true; thin test doubles return false and are simply
+ * skipped by the responder/requester wiring.
+ */
+declare function supportsSessionHandoff(identity: Identity): identity is Identity & SessionHandoff;
 interface Identity {
     readonly isAuthenticated: boolean;
     readonly addresses: Addresses | null;
     readonly credentialId: string | null;
     register(opts?: {
         label?: string;
+        name?: string;
+        email?: string;
     }): Promise<void>;
     login(): Promise<void>;
     logout(): void;
@@ -39,11 +96,12 @@ declare const PRF_INPUT_LABEL = "cere-wallet-prf-v1";
 /**
  * SHA-256("cere-wallet-prf-v1") — 32 bytes. Fed to WebAuthn `prf.eval.first`.
  *
- * Implementation note: `createHash` runs at module evaluation time. In the test
- * environment (Vitest on Node) this works natively via `node:crypto`. In the
- * browser this depends on a `node:crypto` polyfill — `vite-plugin-node-polyfills`
- * is wired in by Cycle 1 Task 8. A follow-up cycle should replace this expression
- * with a hard-coded `Uint8Array` literal to eliminate the polyfill dependency.
+ * Hard-coded as a byte literal so this module is browser-safe with NO
+ * `node:crypto` dependency — it is evaluated at module-load time, and relying on
+ * `createHash` there forced every browser consumer to wire a `node:crypto`
+ * polyfill (`vite-plugin-node-polyfills`). The literal is verified to equal
+ * `sha256(PRF_INPUT_LABEL)` in `constants.test.ts`, so the constant cannot drift
+ * silently. Rotating the label (`-v2`) means recomputing these bytes.
  */
 declare const PRF_INPUT_SEED: Uint8Array;
 /** Spec §3.2. Used as HKDF-SHA256 info to derive the secp256k1 32-byte secret. */
@@ -183,8 +241,18 @@ interface RegisterOptions {
     userHandle: Uint8Array;
     /** 32-byte PRF input (typically `PRF_INPUT_SEED`). */
     prfInput: Uint8Array;
-    /** Human-readable label for the credential. Currently a hint, not stored. */
+    /**
+     * Legacy single label. Used as a fallback for both `user.displayName` and
+     * `user.name` when `name`/`email` are not supplied. Prefer `name` + `email`.
+     */
     label?: string;
+    /** Friendly account name → WebAuthn `user.displayName` (e.g. "Alex Müller"). */
+    name?: string;
+    /**
+     * Account identifier → WebAuthn `user.name` (e.g. "alex@example.com"). This is
+     * the field most OS/browser passkey managers surface to distinguish credentials.
+     */
+    email?: string;
 }
 interface RegisterResult {
     credentialId: string;
@@ -340,12 +408,27 @@ interface IdentityImplOptions {
     apiClient: ApiClient;
     ceremony: CeremonyAdapter;
 }
-declare class IdentityImpl implements Identity {
+declare class IdentityImpl implements Identity, SessionHandoff {
     private readonly opts;
     private readonly vault;
     private cachedJwt;
     /** Server-returned credential ID (used as the public identity.credentialId). */
     private serverCredentialId;
+    /**
+     * Raw derived keys for the CURRENT session, captured at every `vault.set()`
+     * call site (register / login / adoptSession). The vault deliberately hides
+     * the seeds behind its closure (Spec §3.6 invariant 1); this field is the
+     * single, explicit, same-origin-only seam that lets `exportSession()` hand a
+     * live session to a sibling wallet-origin surface (the persistent iframe).
+     * Cleared on logout / cross-tab logout alongside the vault. Never serialised
+     * to storage and never sent to a host page.
+     */
+    private sessionKeys;
+    /**
+     * Absolute expiry (epoch ms) for `exportSession()`. Tracks the cached JWT
+     * expiry after register/login; set from the adopted session in adoptSession.
+     */
+    private sessionExpMs;
     private readonly _isAuthenticated;
     private readonly _addresses;
     private readonly _credentialId;
@@ -372,6 +455,8 @@ declare class IdentityImpl implements Identity {
     private syncPublicState;
     register(opts?: {
         label?: string;
+        name?: string;
+        email?: string;
     }): Promise<void>;
     login(): Promise<void>;
     logout(): void;
@@ -384,6 +469,24 @@ declare class IdentityImpl implements Identity {
      * side use — keys never reach the host. Spec §3.6 invariant 1.
      */
     getVault(): SessionVault;
+    /**
+     * Export the current session for a same-origin handoff (register popup →
+     * iframe). Returns `null` unless the vault is open, we captured the derived
+     * keys, and the session has not expired. The raw seeds ARE included — this is
+     * the deliberate, narrow seam described on `IdentitySession`; callers must
+     * only pass the result across the same-origin wallet BroadcastChannel.
+     */
+    exportSession(): IdentitySession | null;
+    /**
+     * Adopt a session handed over from a same-origin sibling surface. Rebuilds
+     * the `DerivedKeys` from the transported seeds (public keys are recomputed
+     * from the seeds; we do NOT re-run the HKDF step so the exact transported
+     * secpKey is preserved), opens the vault, and syncs public state — no
+     * ceremony. There is no credentialId in the handoff, so login() would need a
+     * fresh ceremony; but the session key is warm, so `sign`/`claim` (which use
+     * the vault directly, no JWT) work immediately.
+     */
+    adoptSession(session: IdentitySession): void;
     /**
      * Release the BroadcastChannel + cross-tab subscriber. Idempotent.
      *
@@ -440,4 +543,4 @@ declare class CrossTabSync {
     close(): void;
 }
 
-export { type Addresses, CERE_SS58_PREFIX, type CeremonyAdapter, type Chain, type CrossTabMessage, CrossTabSync, type DerivedKeys, EVM_HKDF_INFO, type Identity, IdentityImpl, type IdentityImplOptions, type InternalSign, type LoginOptions, type LoginResult, PRF_INPUT_LABEL, PRF_INPUT_SEED, type PrfSupportResult, type RegisterOptions, type RegisterResult, type SessionVault, SoftAuthenticator, type VaultSnapshot, WebAuthnCeremonyAdapter, type WebAuthnCeremonyAdapterOptions, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult };
+export { type Addresses, CERE_SS58_PREFIX, type CeremonyAdapter, type Chain, type CrossTabMessage, CrossTabSync, type DerivedKeys, EVM_HKDF_INFO, type Identity, IdentityImpl, type IdentityImplOptions, type IdentitySession, type InternalSign, type LoginOptions, type LoginResult, PRF_INPUT_LABEL, PRF_INPUT_SEED, type PrfSupportResult, type RegisterOptions, type RegisterResult, type SessionHandoff, type SessionVault, SoftAuthenticator, type VaultSnapshot, WebAuthnCeremonyAdapter, type WebAuthnCeremonyAdapterOptions, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult, supportsSessionHandoff };

package/dist/index.js

@@ -1,4 +1,3 @@
-import { createHash } from 'crypto';
 import bs58 from 'bs58';
 import { blake2b } from '@noble/hashes/blake2b';
 import { keccak_256 } from '@noble/hashes/sha3';
@@ -30,8 +29,48 @@ var __async = (__this, __arguments, generator) => {
     step((generator = generator.apply(__this, __arguments)).next());
   });
 };
+
+// src/types.ts
+function supportsSessionHandoff(identity) {
+  return typeof identity.exportSession === "function" && typeof identity.adoptSession === "function";
+}
+
+// src/constants.ts
 var PRF_INPUT_LABEL = "cere-wallet-prf-v1";
-var PRF_INPUT_SEED = new Uint8Array(createHash("sha256").update(PRF_INPUT_LABEL).digest());
+var PRF_INPUT_SEED = new Uint8Array([
+  241,
+  55,
+  252,
+  128,
+  200,
+  121,
+  231,
+  173,
+  149,
+  167,
+  104,
+  105,
+  124,
+  215,
+  6,
+  125,
+  113,
+  218,
+  113,
+  114,
+  238,
+  51,
+  232,
+  185,
+  156,
+  209,
+  26,
+  46,
+  78,
+  6,
+  58,
+  137
+]);
 var EVM_HKDF_INFO = "cere-wallet-evm-secp256k1-v1";
 
 // src/browser.ts
@@ -144,7 +183,7 @@ var WebAuthnCeremonyAdapter = class {
   }
   register(opts) {
     return __async(this, null, function* () {
-      var _a, _b, _c, _d;
+      var _a, _b, _c, _d, _e, _f;
       if (!this.credentials) {
         throw new Error("WebAuthnCeremonyAdapter: navigator.credentials is unavailable");
       }
@@ -154,8 +193,11 @@ var WebAuthnCeremonyAdapter = class {
           rp: { id: opts.rpId, name: opts.rpId },
           user: {
             id: opts.userHandle,
-            name: (_a = opts.label) != null ? _a : "scp-wallet",
-            displayName: (_b = opts.label) != null ? _b : "SCP Wallet"
+            // WebAuthn convention: `name` is the account identifier (email), shown
+            // by passkey managers; `displayName` is the friendly name. Fall back to
+            // the legacy single `label`, then the product defaults.
+            name: (_b = (_a = opts.email) != null ? _a : opts.label) != null ? _b : "scp-wallet",
+            displayName: (_d = (_c = opts.name) != null ? _c : opts.label) != null ? _d : "SCP Wallet"
           },
           pubKeyCredParams: [
             { alg: -8, type: "public-key" },
@@ -185,7 +227,7 @@ var WebAuthnCeremonyAdapter = class {
       const response = cred.response;
       const transports = typeof response.getTransports === "function" ? response.getTransports() : [];
       const ext = cred.getClientExtensionResults();
-      const prfFirst = (_d = (_c = ext == null ? void 0 : ext.prf) == null ? void 0 : _c.results) == null ? void 0 : _d.first;
+      const prfFirst = (_f = (_e = ext == null ? void 0 : ext.prf) == null ? void 0 : _e.results) == null ? void 0 : _f.first;
       return {
         credentialId: cred.id,
         clientDataJSON: bytesToB64u(response.clientDataJSON),
@@ -459,6 +501,21 @@ var IdentityImpl = class {
     this.cachedJwt = null;
     /** Server-returned credential ID (used as the public identity.credentialId). */
     this.serverCredentialId = null;
+    /**
+     * Raw derived keys for the CURRENT session, captured at every `vault.set()`
+     * call site (register / login / adoptSession). The vault deliberately hides
+     * the seeds behind its closure (Spec §3.6 invariant 1); this field is the
+     * single, explicit, same-origin-only seam that lets `exportSession()` hand a
+     * live session to a sibling wallet-origin surface (the persistent iframe).
+     * Cleared on logout / cross-tab logout alongside the vault. Never serialised
+     * to storage and never sent to a host page.
+     */
+    this.sessionKeys = null;
+    /**
+     * Absolute expiry (epoch ms) for `exportSession()`. Tracks the cached JWT
+     * expiry after register/login; set from the adopted session in adoptSession.
+     */
+    this.sessionExpMs = null;
     // Public observable state — derived from vault snapshot + serverCredentialId.
     // Kept in sync via syncPublicState() so React `observer()` wrappers around
     // components reading isAuthenticated/addresses/credentialId actually re-render
@@ -482,6 +539,8 @@ var IdentityImpl = class {
         this.vault.clear();
         this.cachedJwt = null;
         this.serverCredentialId = null;
+        this.sessionKeys = null;
+        this.sessionExpMs = null;
         this.syncPublicState();
       }
     });
@@ -525,7 +584,9 @@ var IdentityImpl = class {
         challenge: b64uDecode(start.challenge),
         userHandle: b64uDecode(start.userHandle),
         prfInput: PRF_INPUT_SEED,
-        label: opts.label
+        label: opts.label,
+        name: opts.name,
+        email: opts.email
       });
       if (!cer.prfOutput) {
         throw new WalletError("prf-unsupported", "authenticator did not return a PRF output");
@@ -555,6 +616,8 @@ var IdentityImpl = class {
       });
       this.serverCredentialId = finish.credentialId;
       this.cachedJwt = { token: finish.token, expMs: decodeJwtExpMs(finish.token) };
+      this.sessionKeys = keys;
+      this.sessionExpMs = this.cachedJwt.expMs;
       this.syncPublicState();
     });
   }
@@ -592,6 +655,8 @@ var IdentityImpl = class {
       });
       this.serverCredentialId = finish.credentialId;
       this.cachedJwt = { token: finish.token, expMs: decodeJwtExpMs(finish.token) };
+      this.sessionKeys = keys;
+      this.sessionExpMs = this.cachedJwt.expMs;
       this.syncPublicState();
     });
   }
@@ -599,6 +664,8 @@ var IdentityImpl = class {
     this.vault.clear();
     this.cachedJwt = null;
     this.serverCredentialId = null;
+    this.sessionKeys = null;
+    this.sessionExpMs = null;
     this.syncPublicState();
     this.crossTabSync.broadcast({ type: "logout" });
   }
@@ -627,6 +694,59 @@ var IdentityImpl = class {
   getVault() {
     return this.vault;
   }
+  /**
+   * Export the current session for a same-origin handoff (register popup →
+   * iframe). Returns `null` unless the vault is open, we captured the derived
+   * keys, and the session has not expired. The raw seeds ARE included — this is
+   * the deliberate, narrow seam described on `IdentitySession`; callers must
+   * only pass the result across the same-origin wallet BroadcastChannel.
+   */
+  exportSession() {
+    var _a, _b, _c;
+    if (!this.vault.isOpen() || !this.sessionKeys) return null;
+    const snap = this.vault.snapshot();
+    if (!snap) return null;
+    const expMs = (_c = (_b = this.sessionExpMs) != null ? _b : (_a = this.cachedJwt) == null ? void 0 : _a.expMs) != null ? _c : 0;
+    if (expMs <= Date.now()) return null;
+    return {
+      // Copy so the caller (and the structured clone the BroadcastChannel makes)
+      // cannot mutate our live key buffers.
+      edSeed: new Uint8Array(this.sessionKeys.edSeed),
+      secpKey: new Uint8Array(this.sessionKeys.secpKey),
+      addresses: snap.addresses,
+      expMs
+    };
+  }
+  /**
+   * Adopt a session handed over from a same-origin sibling surface. Rebuilds
+   * the `DerivedKeys` from the transported seeds (public keys are recomputed
+   * from the seeds; we do NOT re-run the HKDF step so the exact transported
+   * secpKey is preserved), opens the vault, and syncs public state — no
+   * ceremony. There is no credentialId in the handoff, so login() would need a
+   * fresh ceremony; but the session key is warm, so `sign`/`claim` (which use
+   * the vault directly, no JWT) work immediately.
+   */
+  adoptSession(session) {
+    if (session.expMs <= Date.now()) return;
+    const edSeed = new Uint8Array(session.edSeed);
+    const secpKey = new Uint8Array(session.secpKey);
+    const keys = {
+      edSeed,
+      secpKey,
+      edPubkey: ed25519.getPublicKey(edSeed),
+      secpPubkeyUncompressed: secp256k1.getPublicKey(secpKey, false)
+    };
+    this.vault.set({
+      keys,
+      addresses: session.addresses,
+      // No credentialId travels in the handoff. login() (which needs it) will
+      // fall back to a fresh ceremony; the adopted key covers ceremony-free ops.
+      credentialId: ""
+    });
+    this.sessionKeys = keys;
+    this.sessionExpMs = session.expMs;
+    this.syncPublicState();
+  }
   /**
    * Release the BroadcastChannel + cross-tab subscriber. Idempotent.
    *
@@ -662,6 +782,6 @@ var IdentityImpl = class {
   }
 };
 
-export { CERE_SS58_PREFIX, CrossTabSync, EVM_HKDF_INFO, IdentityImpl, PRF_INPUT_LABEL, PRF_INPUT_SEED, SoftAuthenticator, WebAuthnCeremonyAdapter, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult };
+export { CERE_SS58_PREFIX, CrossTabSync, EVM_HKDF_INFO, IdentityImpl, PRF_INPUT_LABEL, PRF_INPUT_SEED, SoftAuthenticator, WebAuthnCeremonyAdapter, b64uToBytes, bytesToB64u, createSessionVault, decodeEd25519Pubkey, deriveCereAddress, deriveEvmAddress, deriveSolanaAddress, derivedKeys, detectPrfSupport, isPrfSupportedResult, supportsSessionHandoff };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map