@seams/wallet 0.5.1 → 0.5.2

package/dist/public/sdk/workers/passkey-mpc-session.worker.js

@@ -1 +1,1717 @@
-function F0($,J){if($==null)return{ok:!1,error:{code:"missing",message:`${J} is required`}};if(typeof $!=="string")return{ok:!1,error:{code:"invalid",message:`${J} must be a string`}};let X=$.trim();if(!X)return{ok:!1,error:{code:"missing",message:`${J} is required`}};return{ok:!0,value:X}}function i($){return F0($,"thresholdSessionId")}function s($){return typeof $==="object"&&$!==null?$:null}function B0($){let J=s($);if(!J)return null;if(J.kind==="all")return{kind:"all"};if(J.kind!=="session")return null;let X=i(J.thresholdSessionId);if(!X.ok)return null;return{kind:"session",thresholdSessionId:X.value}}function r($){let J=s($);if(!J||J.kind!=="clear_volatile_warm_material")return null;if(J.durableRecord!=null||J.resolvedIdentity!=null||J.deleteReason!=null)return null;let X=B0(J.scope);if(!X)return null;return{kind:"clear_volatile_warm_material",scope:X}}function a($){return`0x${Array.from($).map((J)=>J.toString(16).padStart(2,"0")).join("")}`}var z0=($)=>{let J=ArrayBuffer.isView($)?new Uint8Array($.buffer,$.byteOffset,$.byteLength):new Uint8Array($),X="";for(let Y=0;Y<J.length;Y++)X+=String.fromCharCode(J[Y]);return btoa(X)};var e=($)=>{return z0($).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")};var $0=32;function E0($=$0,J="secure random bytes"){let X=Math.max(1,Math.floor(Number($)||0)),Y=globalThis.crypto;if(typeof Y?.getRandomValues!=="function")throw new Error(`WebCrypto getRandomValues is required for ${J}`);return Y.getRandomValues(new Uint8Array(X))}function J0($=$0,J="secure random id"){return e(E0($,J))}var f="rfc2409-group2";var X0="/wallet-session/seal",O8=new Uint8Array([64,12,49,139,102,149,151,54,89,161,105,138,229,128,223,216,0,29,153,81,186,50,198,149,230,52,153,71,80,79,63,132]),F8=new Uint8Array([38,218,80,229,172,150,74,126,160,132,82,127,182,71,246,51,11,50,222,81,169,175,70,82,75,0,109,143,127,231,244,209]);function Y0($){return typeof $==="string"?$:""}function P($){return Y0($).trim()}function w($){return String($??"").trim()}function U($){return w($)||void 0}function A0($){let J=typeof $==="number"?$:Number($);if(!Number.isFinite(J))return null;return J}function v($){let J=A0($);if(J==null)return null;return Math.trunc(J)}function p($){let J=v($);if(J==null||J<=0)return null;return J}function u($){let J=v($);if(J==null||J<0)return null;return J}function Z0($){return String($??"").replace(/\/+$/,"")}function Q0($){let J=w($);if(!J)return"";return J.startsWith("/")?J:`/${J}`}function C0($,J){let X=Z0(w($)),Y=Q0(w(J));if(!X)throw new Error("Missing base URL");return`${X}${Y}`}function D0(){if(typeof window==="undefined")return;let $=window,J=$.__W3A_WALLET_SDK_BASE__;return typeof J==="string"&&J.length>0?J:void 0}function o(){return typeof self!=="undefined"?self??null:null}function _0(){return o()?.location?.href}function x0(){return o()?.location?.origin}function V0($,J,X){if(X)return new URL($,X);if(typeof process!=="undefined"&&process.env?.WASM_BASE_URL)return new URL($,process.env.WASM_BASE_URL);let Y=J.toUpperCase().replace(/[^A-Z]/g,"_")+"_WASM_BASE_URL";if(typeof process!=="undefined"&&process.env?.[Y])return new URL($,process.env[Y]);let Z=o();if(Z?.WASM_BASE_URL)return new URL($,Z.WASM_BASE_URL);try{let Q=D0();if(Q)return new URL(`workers/${$}`,Q)}catch{}try{let Q=null;try{Q=typeof import.meta!=="undefined"&&import.meta?.url?import.meta.url:null}catch{Q=null}if(Q){let V=new URL(Q,_0());if(V.protocol==="http:"||V.protocol==="https:"){let _=V.pathname.indexOf("/sdk/");if(_>=0){let C=V.pathname.slice(0,_+5);return new URL(`${C}workers/${$}`,V.origin)}}return new URL(`./${$}`,V)}let D=_0()||"/";return new URL(`./${$}`,D)}catch{return new URL(`/sdk/workers/${$}`,x0()||"/")}}function k0($){if($.length>=255)throw new TypeError("Alphabet too long");let J=new Uint8Array(256);for(let C=0;C<J.length;C++)J[C]=255;for(let C=0;C<$.length;C++){let G=$.charAt(C),q=G.charCodeAt(0);if(J[q]!==255)throw new TypeError(G+" is ambiguous");J[q]=C}let X=$.length,Y=$.charAt(0),Z=Math.log(X)/Math.log(256),Q=Math.log(256)/Math.log(X);function D(C){if(C instanceof Uint8Array);else if(ArrayBuffer.isView(C))C=new Uint8Array(C.buffer,C.byteOffset,C.byteLength);else if(Array.isArray(C))C=Uint8Array.from(C);if(!(C instanceof Uint8Array))throw new TypeError("Expected Uint8Array");if(C.length===0)return"";let G=0,q=0,N=0,W=C.length;while(N!==W&&C[N]===0)N++,G++;let K=(W-N)*Q+1>>>0,M=new Uint8Array(K);while(N!==W){let T=C[N],j=0;for(let R=K-1;(T!==0||j<q)&&R!==-1;R--,j++)T+=256*M[R]>>>0,M[R]=T%X>>>0,T=T/X>>>0;if(T!==0)throw new Error("Non-zero carry");q=j,N++}let H=K-q;while(H!==K&&M[H]===0)H++;let B=Y.repeat(G);for(;H<K;++H)B+=$.charAt(M[H]);return B}function V(C){if(typeof C!=="string")throw new TypeError("Expected String");if(C.length===0)return new Uint8Array;let G=0,q=0,N=0;while(C[G]===Y)q++,G++;let W=(C.length-G)*Z+1>>>0,K=new Uint8Array(W);while(G<C.length){let T=C.charCodeAt(G);if(T>255)return;let j=J[T];if(j===255)return;let R=0;for(let I=W-1;(j!==0||R<N)&&I!==-1;I--,R++)j+=X*K[I]>>>0,K[I]=j%256>>>0,j=j/256>>>0;if(j!==0)throw new Error("Non-zero carry");N=R,G++}let M=W-N;while(M!==W&&K[M]===0)M++;let H=new Uint8Array(q+(W-M)),B=q;while(M!==W)H[B++]=K[M++];return H}function _(C){let G=V(C);if(G)return G;throw new Error("Non-base"+X+" character")}return{encode:D,decodeUnsafe:V,decode:_}}var G0=k0;var I0="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz",b0=G0(I0);function W0($,J,X="is required"){let Y=P($);if(!Y)throw new Error(`${J} ${X}`);return Y}var g=null,y=null,L0=0,E=new Map,q0=15000;function m($,J){return W0($,J,"must be a non-empty string")}function K0($){return typeof $==="object"&&$!==null}function S0($){if(!K0($))throw new Error("Invalid Shamir3Pass key handle response");return{keyHandle:m($.keyHandle,"keyHandle")}}function f0($){let J=String($.code||"").trim(),X=m($.error,"error");return new Error(J?`[shamir3pass-worker] ${J}: ${X}`:`[shamir3pass-worker] ${X}`)}function w0($){if(!K0($))return null;let J=String($.id||"").trim();if(!J||typeof $.ok!=="boolean")return null;if($.ok)return{id:J,ok:!0,result:$.result};return{id:J,ok:!1,error:String($.error||"Worker request failed"),...String($.code||"").trim()?{code:String($.code).trim()}:{}}}function y0(){return L0+=1,`shamir3pass-${Date.now()}-${L0}`}function m0($){let J=Array.from(E.values());E.clear();for(let X of J){clearTimeout(X.timeoutId);try{X.reject(new Error($))}catch{}}}function H0($){let J=y;if(y=null,J)try{J.terminate()}catch{}m0($)}function h0(){let $=globalThis.Worker;if(typeof $!=="function")throw new Error("Shamir3Pass worker is unavailable in this runtime");return $}function p0(){if(y)return y;let $=h0(),J=V0("shamir3pass.worker.js","Shamir3Pass Worker"),X=new $(J,{type:"module",name:"shamir3pass-worker"});return X.onmessage=(Y)=>{let Z=w0(Y.data);if(!Z)return;let Q=E.get(Z.id);if(!Q)return;if(E.delete(Z.id),clearTimeout(Q.timeoutId),Z.ok){Q.resolve(Z.result);return}Q.reject(f0(Z))},X.onerror=(Y)=>{let Z=String(Y?.message||"Unknown worker error").trim();H0(`[shamir3pass-worker] ${Z||"Worker crashed"}`)},X.onmessageerror=()=>{H0("[shamir3pass-worker] Failed to deserialize worker message")},y=X,X}function k($,J,X){let Y=y0(),Z=p0();return new Promise((Q,D)=>{let V=setTimeout(()=>{E.delete(Y),D(new Error(`[shamir3pass-worker] Request timed out after ${q0}ms`))},q0);E.set(Y,{resolve:Q,reject:D,timeoutId:V});let _={id:Y,type:$,payload:J};try{Z.postMessage(_,X||[])}catch(C){let G=E.get(Y);if(G)E.delete(Y),clearTimeout(G.timeoutId);D(C instanceof Error?C:new Error(String(C||"Worker postMessage failed")))}})}function g0(){return{createClientKeyHandle:async({groupId:$})=>S0(await k("createClientKeyHandle",{groupId:$})),destroyClientKeyHandle:async({keyHandle:$})=>{await k("destroyClientKeyHandle",{keyHandle:$})},addClientSealWithKeyHandle:async({ciphertextB64u:$,keyHandle:J})=>m(await k("addClientSealWithKeyHandle",{ciphertextB64u:$,keyHandle:J}),"ciphertextB64u"),addClientSealBytesWithKeyHandle:async({ciphertext:$,keyHandle:J})=>{let X=$.slice();return m(await k("addClientSealBytesWithKeyHandle",{ciphertext:X.buffer,keyHandle:J},[X.buffer]),"ciphertextB64u")},removeClientSealWithKeyHandle:async({ciphertextB64u:$,keyHandle:J})=>m(await k("removeClientSealWithKeyHandle",{ciphertextB64u:$,keyHandle:J}),"ciphertextB64u"),removeClientSealWithKeyHandleToBytes:async({ciphertextB64u:$,keyHandle:J})=>{let X=await k("removeClientSealWithKeyHandleToBytes",{ciphertextB64u:$,keyHandle:J});if(!(X instanceof ArrayBuffer))throw new Error("ciphertext bytes response must be an ArrayBuffer");return new Uint8Array(X)}}}async function N0(){let $=performance.now();try{return await k("warmup",{}),{kind:"succeeded",elapsedMs:Math.max(0,Math.round(performance.now()-$))}}catch{return{kind:"failed",elapsedMs:Math.max(0,Math.round(performance.now()-$))}}}async function n(){if(!g)g=Promise.resolve(g0()).catch(($)=>{throw g=null,$});return g}var c0=32,x=new Map,b=new Map,z=new Map,t=new Map,d=new Map,v0=X0,M0=15000;function u0($){$.abort("timeout")}function o0($){return typeof $==="string"?P($)||void 0:void 0}function O($){if(typeof $!=="string")return null;return P($)||null}function S($){return typeof $==="number"&&Number.isSafeInteger($)?$:null}function n0($){if(!Array.isArray($))return null;let J=Object.keys($);if(J.length!==$.length||J.some((Y)=>!/^\d+$/.test(Y)))return null;let X=[];for(let Y=0;Y<$.length;Y+=1){let Z=O($[Y]);if(!Z)return null;X.push(Z)}return X}function t0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.some((_)=>!["thresholdSessionId","prfFirstB64u","expiresAtMs","remainingUses","transport"].includes(_))||!["thresholdSessionId","prfFirstB64u","expiresAtMs","remainingUses"].every((_)=>J.includes(_)))return null;let X=O(Reflect.get($,"thresholdSessionId")),Y=O(Reflect.get($,"prfFirstB64u")),Z=S(Reflect.get($,"expiresAtMs")),Q=S(Reflect.get($,"remainingUses")),D=J.includes("transport"),V=D?l(Reflect.get($,"transport")):void 0;if(!X||!Y||Z===null||Q===null||D&&!V)return null;return{thresholdSessionId:X,prfFirstB64u:Y,expiresAtMs:Z,remainingUses:Q,...V?{transport:V}:{}}}function d0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.length!==1||J[0]!=="thresholdSessionId")return null;let X=O(Reflect.get($,"thresholdSessionId"));return X?{thresholdSessionId:X}:null}function l0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.length!==1||J[0]!=="thresholdSessionIds")return null;let X=n0(Reflect.get($,"thresholdSessionIds"));return X?{thresholdSessionIds:X}:null}function i0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.some((C)=>!["thresholdSessionId","uses","consume","curve"].includes(C))||!J.includes("thresholdSessionId"))return null;let X=O(Reflect.get($,"thresholdSessionId")),Z=J.includes("uses")?S(Reflect.get($,"uses")):1,D=J.includes("consume")?Reflect.get($,"consume"):!0,_=J.includes("curve")?Reflect.get($,"curve"):void 0;if(!X||Z===null||Z<1||typeof D!=="boolean"||_!==void 0&&_!=="ed25519"&&_!=="ecdsa")return null;return{thresholdSessionId:X,uses:Z,consume:D,..._!==void 0?{curve:_}:{}}}function s0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.some((V)=>!["thresholdSessionId","uses","curve"].includes(V))||!J.includes("thresholdSessionId"))return null;let X=O(Reflect.get($,"thresholdSessionId")),Z=J.includes("uses")?S(Reflect.get($,"uses")):1,D=J.includes("curve")?Reflect.get($,"curve"):void 0;if(!X||Z===null||Z<1||D!==void 0&&D!=="ed25519"&&D!=="ecdsa")return null;return{thresholdSessionId:X,uses:Z,...D!==void 0?{curve:D}:{}}}function r0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($);if(J.length!==2||!J.includes("thresholdSessionId")||!J.includes("transport"))return null;let X=O(Reflect.get($,"thresholdSessionId")),Y=l(Reflect.get($,"transport"));return X&&Y?{thresholdSessionId:X,transport:Y}:null}function a0($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Object.keys($),X=["thresholdSessionId","sealedSecretB64u","expiresAtMs","remainingUses","transport"];if(J.some((G)=>![...X,"signingSessionSealKeyVersion"].includes(G))||X.some((G)=>!J.includes(G)))return null;let Y=O(Reflect.get($,"thresholdSessionId")),Z=O(Reflect.get($,"sealedSecretB64u")),Q=S(Reflect.get($,"expiresAtMs")),D=S(Reflect.get($,"remainingUses")),V=l(Reflect.get($,"transport")),_=J.includes("signingSessionSealKeyVersion"),C=_?O(Reflect.get($,"signingSessionSealKeyVersion")):void 0;if(!Y||!Z||Q===null||D===null||!V||_&&!C)return null;return{thresholdSessionId:Y,sealedSecretB64u:Z,expiresAtMs:Q,remainingUses:D,...C?{keyVersion:C}:{},transport:V}}function e0($){if($===null||typeof $!=="object"||Array.isArray($))return{kind:"unknown",type:void 0};let J=Object.keys($);if(J.some((D)=>!["id","type","payload"].includes(D))||!J.includes("type"))return{kind:"unknown",type:Reflect.get($,"type")};let X=J.includes("id")?o0(Reflect.get($,"id")):void 0;if(J.includes("id")&&X===void 0)return{kind:"unknown",type:Reflect.get($,"type")};let Y=Reflect.get($,"type"),Z=J.includes("payload"),Q=Z?Reflect.get($,"payload"):void 0;switch(Y){case"PING":return J.length===(J.includes("id")?2:1)?{kind:"ping",...X?{id:X}:{}}:{kind:"unknown",id:X,type:Y};case"PREWARM_SHAMIR3PASS":if(!Z||Q===null||typeof Q!=="object"||Array.isArray(Q))return{kind:"unknown",id:X,type:Y};if(Object.keys(Q).length!==0)return{kind:"unknown",id:X,type:Y};return{kind:"prewarm",...X?{id:X}:{}};case"WARM_SESSION_MATERIAL_PUT":return{kind:"material_put",...X?{id:X}:{},payload:Z?t0(Q):null};case"WARM_SESSION_STATUS_READ":return{kind:"status_read",...X?{id:X}:{},payload:Z?d0(Q):null};case"WARM_SESSION_STATUS_BATCH_READ":return{kind:"status_batch_read",...X?{id:X}:{},payload:Z?l0(Q):null};case"WARM_SESSION_MATERIAL_CLAIM":return{kind:"material_claim",...X?{id:X}:{},payload:Z?i0(Q):null};case"WARM_SESSION_MATERIAL_CONSUME":return{kind:"material_consume",...X?{id:X}:{},payload:Z?s0(Q):null};case"WARM_SESSION_VOLATILE_MATERIAL_CLEAR":return Z?{kind:"volatile_clear",...X?{id:X}:{},payload:Q}:{kind:"unknown",id:X,type:Y};case"WARM_SESSION_VOLATILE_MATERIAL_CLEAR_ALL":return Z?{kind:"volatile_clear_all",...X?{id:X}:{},payload:Q}:{kind:"unknown",id:X,type:Y};case"WARM_SESSION_SEAL_AND_PERSIST":return{kind:"seal_and_persist",...X?{id:X}:{},payload:Z?r0(Q):null};case"WARM_SESSION_REHYDRATE":return{kind:"rehydrate",...X?{id:X}:{},payload:Z?a0(Q):null};default:return{kind:"unknown",id:X,type:Y}}}function F(){return Date.now()}function $8($){return Math.max(0,Math.round(performance.now()-$))}function J8(){return{runtimeSetupMs:0,clientSealMs:0,serverSealRouteMs:0,clientUnsealMs:0,policyUpdateMs:0}}function h($){$.diagnostics[$.bucket]+=$8($.startedAt)}function X8($){return`${String($||"").trim()||"session"}:${J0(32,"passkey confirm worker session IDs")}`}function Y8($){let J=P($.prfFirstB64u),X=Math.floor(Number($.expiresAtMs)||0);if(!J||X<=F())throw new Error("Invalid passkey PRF material handle input");let Y=X8("passkey-prf-first");return b.set(Y,{prfFirstB64u:J,expiresAtMs:X}),Y}async function Z8($){let J=await crypto.subtle.digest("SHA-256",new TextEncoder().encode($));return a(new Uint8Array(J))}async function Q8($){let J=P($.prfFirstB64u),X=P($.relayerUrl),Y=U($.keyVersion),Z=$.cacheScope;if(!J||!X||!Y||!Z)return null;let Q=await Z8(J);return["passkey-server-sealed-secret-v1",X,Y,f,Z.walletId,Z.credentialIdB64u,Z.walletSessionId,Z.quotaId,Q].join("|")}function U0(){let $=F();for(let[J,X]of z)if(X.expiresAtMs<=$)z.delete(J);while(z.size>c0){let J=z.keys().next().value;if(typeof J!=="string")return;z.delete(J)}}function C8($){if(!$)return null;U0();let J=z.get($);if(!J||J.expiresAtMs<=F()){if(J)z.delete($);return null}return J}function D8($){if(!$.cacheKey)return;let J=P($.sealedSecretB64u),X=Math.floor(Number($.expiresAtMs)||0);if(!J||X<=F())return;z.set($.cacheKey,{sealedSecretB64u:J,expiresAtMs:X}),U0()}function A($){let J=x.get($);if(J)b.delete(J.prfFirstHandle);x.delete($)}function _8(){x.clear(),b.clear(),z.clear()}function R0($){let J=P($.thresholdSessionId),X=Math.floor(Number($.remainingUses)||0),Y=Math.floor(Number($.expiresAtMs)||0);if(!J||X<=0||Y<=F())throw new Error("Invalid warm-session PRF handle input");A(J);let Q={prfFirstHandle:Y8({prfFirstB64u:$.prfFirstB64u,expiresAtMs:Y}),expiresAtMs:Y,remainingUses:X};return x.set(J,Q),Q}function V8($,J,X){let Y={prfFirstHandle:J.prfFirstHandle,remainingUses:X.remainingUses,expiresAtMs:X.expiresAtMs},Z=b.get(J.prfFirstHandle);if(Z)b.set(J.prfFirstHandle,{prfFirstB64u:Z.prfFirstB64u,expiresAtMs:X.expiresAtMs});return x.set($,Y),Y}function l($){if($===null||typeof $!=="object"||Array.isArray($))return null;let J=Reflect.get($,"curve"),X=Reflect.get($,"authMethod"),Y=J==="ed25519"?["curve","authMethod","walletId","relayerUrl","walletSessionToken","ed25519Restore"]:J==="ecdsa"?["curve","authMethod","walletId","chainTarget","relayerUrl","walletSessionToken","ecdsaRestore"]:[],Z=["signingSessionSealKeyVersion","groupId","serverSealedSecretCacheScope"],Q=Object.keys($);if(J!=="ed25519"&&J!=="ecdsa"||X!=="passkey"||Q.some((H)=>![...Y,...Z].includes(H))||Y.some((H)=>!Q.includes(H)))return null;let D=O(Reflect.get($,"walletId")),V=U(Reflect.get($,"relayerUrl")),_=U(Reflect.get($,"walletSessionToken")),C=Reflect.get($,J==="ed25519"?"ed25519Restore":"ecdsaRestore"),G=J==="ecdsa"?Reflect.get($,"chainTarget"):void 0,q=Reflect.get($,"signingSessionSealKeyVersion"),N=Q.includes("signingSessionSealKeyVersion"),W=U(q),K=Q.includes("serverSealedSecretCacheScope"),M=G8(Reflect.get($,"serverSealedSecretCacheScope"));if(!D||!V||!_||C===null||typeof C!=="object"||Array.isArray(C)||J==="ecdsa"&&(G===null||typeof G!=="object"||Array.isArray(G))||N&&!W||K&&!M)return null;return{relayerUrl:V,walletSessionToken:_,...N&&W?{keyVersion:W}:{},...M?{serverSealedSecretCacheScope:M}:{}}}function G8($){if($===null||typeof $!=="object"||Array.isArray($))return;let J=Object.keys($);if(J.length!==5||!["kind","walletId","credentialIdB64u","walletSessionId","quotaId"].every((D)=>J.includes(D))||Reflect.get($,"kind")!=="passkey_registration")return;let X=U(Reflect.get($,"walletId")),Y=U(Reflect.get($,"credentialIdB64u")),Z=U(Reflect.get($,"walletSessionId")),Q=U(Reflect.get($,"quotaId"));if(!X||!Y||!Z||!Q)return;return{kind:"passkey_registration",walletId:X,credentialIdB64u:Y,walletSessionId:Z,quotaId:Q}}function W8($){if($===null||typeof $!=="object"||Array.isArray($))return{ok:!1,code:"invalid_response",message:"Invalid signing-session seal response"};let J=Reflect.get($,"ok");if(typeof J!=="boolean")return{ok:!1,code:"invalid_response",message:"Invalid signing-session seal response"};let X=Object.keys($),Y=J?["ok","ciphertext","keyVersion","expiresAtMs","remainingUses"]:["ok","code","message"];if(X.some((_)=>!Y.includes(_)))return{ok:!1,code:"invalid_response",message:"Invalid signing-session seal response"};if(!J){let _=Reflect.get($,"code"),C=Reflect.get($,"message");return{ok:!1,code:typeof _==="string"?_:"request_failed",message:typeof C==="string"?C:"Signing-session seal request failed"}}let Z=P(Reflect.get($,"ciphertext")),Q=U(Reflect.get($,"keyVersion")),D=p(Reflect.get($,"expiresAtMs")),V=u(Reflect.get($,"remainingUses"));if(!Z)return{ok:!1,code:"invalid_response",message:"Missing ciphertext in signing-session seal response"};return{ok:!0,ciphertext:Z,...Q?{keyVersion:Q}:{},...D!=null?{expiresAtMs:D}:{},...V!=null?{remainingUses:V}:{}}}function T0($){let J=$.operation==="apply-server-seal"?"apply-server-seal":"remove-server-seal",X=P($.thresholdSessionId)||"",Y=P($.relayerUrl)||"",Z=U($.keyVersion)||"",Q=U($.payloadKey)||"";return`${J}|${X}|${Y}|${Z}|${f}|${Q}`}async function j0($){let J=$.operation==="apply-server-seal"?"apply-server-seal":"remove-server-seal",X=C0($.transport.relayerUrl,`${v0}/${J}`),Y=new AbortController,Z=setTimeout(u0,M0,Y);try{let Q={"Content-Type":"application/json"},D=U($.keyVersion);Q.Authorization=`Bearer ${$.transport.walletSessionToken}`;let V=await fetch(X,{method:"POST",credentials:"omit",headers:Q,signal:Y.signal,body:JSON.stringify({thresholdSessionId:$.thresholdSessionId,ciphertext:$.ciphertext,...D?{keyVersion:D}:{}})}),_=await V.json().catch(()=>null),C=W8(_);if(!V.ok&&C.ok)return{ok:!1,code:"http_error",message:`Signing-session seal route returned HTTP ${V.status}`};if(!C.ok)return C;return C}catch(Q){return{ok:!1,code:Y.signal.aborted?"timeout":"network_error",message:Y.signal.aborted?`Signing-session seal request timed out after ${M0}ms`:Q instanceof Error?Q.message:String(Q||"Signing-session seal request failed")}}finally{clearTimeout(Z)}}function O0($){let J=Math.max(0,Math.floor(Number($.localRemainingUses)||0)),X=Math.max(0,Math.floor(Number($.localExpiresAtMs)||0)),Y=u($.serverRemainingUses)??J,Z=p($.serverExpiresAtMs)||X,Q=Math.min(J,Y),D=Math.min(X,Z);if(Q<=0)return{ok:!1,code:"exhausted",message:"Warm-session material exhausted for threshold session"};if(D<=F())return{ok:!1,code:"expired",message:"Warm-session material expired for threshold session"};return{ok:!0,remainingUses:Q,expiresAtMs:D}}function c($){if(!$)return{ok:!1,code:"invalid_args",message:"Missing threshold sessionId"};let J=x.get($);if(!J)return{ok:!1,code:"not_found",message:"Warm-session material is not available for threshold session"};if(F()>=J.expiresAtMs)return A($),{ok:!1,code:"expired",message:"Warm-session material expired for threshold session"};if(J.remainingUses<=0)return A($),{ok:!1,code:"exhausted",message:"Warm-session material exhausted for threshold session"};let X=b.get(J.prfFirstHandle);if(!X||F()>=X.expiresAtMs)return A($),{ok:!1,code:"not_found",message:"Warm-session material handle is not available for threshold session"};return{ok:!0,entry:J,secret:X,remainingUses:J.remainingUses,expiresAtMs:J.expiresAtMs}}function P0($){let J=c($);if(!J.ok)return J;return{ok:!0,remainingUses:J.remainingUses,expiresAtMs:J.expiresAtMs}}function L8($,J,X){let Y=c($);if(!Y.ok)return Y;let Z=Y.entry,Q=Math.max(1,Math.floor(Number(J)||1));if(Z.remainingUses<Q)return{ok:!1,code:"exhausted",message:"Warm-session material exhausted for threshold session"};if(X)if(Z.remainingUses-=Q,Z.remainingUses<=0)A($);else x.set($,Z);return{ok:!0,prfFirstB64u:Y.secret.prfFirstB64u,remainingUses:Z.remainingUses,expiresAtMs:Z.expiresAtMs}}function q8($,J){let X=c($);if(!X.ok)return X;let Y=X.entry,Z=Math.max(1,Math.floor(Number(J)||1));if(Y.remainingUses<Z)return{ok:!1,code:"exhausted",message:"Warm-session material exhausted for threshold session"};if(Y.remainingUses-=Z,Y.remainingUses<=0)A($);else x.set($,Y);return{ok:!0,remainingUses:Y.remainingUses,expiresAtMs:Y.expiresAtMs}}async function H8($){let J=P($.thresholdSessionId);if(!J)return{ok:!1,code:"invalid_args",message:"Missing threshold sessionId"};let X=c(J);if(!X.ok)return X;let Y=X.entry,Z=T0({operation:"apply-server-seal",thresholdSessionId:J,relayerUrl:$.transport.relayerUrl,keyVersion:$.transport.keyVersion,payloadKey:Y.prfFirstHandle}),Q=t.get(Z);if(Q)return await Q;let D=(async()=>{let V=J8();try{let _=performance.now(),C=await n(),G=await C.createClientKeyHandle({groupId:f});h({diagnostics:V,bucket:"runtimeSetupMs",startedAt:_});try{let q=performance.now(),N=await C.addClientSealWithKeyHandle({ciphertextB64u:X.secret.prfFirstB64u,keyHandle:G.keyHandle});h({diagnostics:V,bucket:"clientSealMs",startedAt:q});let W=performance.now(),K=await j0({operation:"apply-server-seal",transport:$.transport,thresholdSessionId:J,ciphertext:N,keyVersion:$.transport.keyVersion});if(h({diagnostics:V,bucket:"serverSealRouteMs",startedAt:W}),!K.ok)return K;let M=performance.now(),H=O0({localRemainingUses:Y.remainingUses,localExpiresAtMs:Y.expiresAtMs,serverRemainingUses:K.remainingUses,serverExpiresAtMs:K.expiresAtMs});if(!H.ok)return A(J),H;V8(J,Y,H),h({diagnostics:V,bucket:"policyUpdateMs",startedAt:M});let B=U(K.keyVersion)||U($.transport.keyVersion),T=B?await Q8({prfFirstB64u:X.secret.prfFirstB64u,relayerUrl:$.transport.relayerUrl,keyVersion:B,cacheScope:$.transport.serverSealedSecretCacheScope}):null,R=C8(T)?.sealedSecretB64u||"";if(!R){let I=performance.now();R=await C.removeClientSealWithKeyHandle({ciphertextB64u:K.ciphertext,keyHandle:G.keyHandle}),h({diagnostics:V,bucket:"clientUnsealMs",startedAt:I}),D8({cacheKey:T,sealedSecretB64u:R,expiresAtMs:H.expiresAtMs})}return{ok:!0,sealedSecretB64u:R,...B?{keyVersion:B}:{},remainingUses:H.remainingUses,expiresAtMs:H.expiresAtMs,diagnostics:V}}finally{await C.destroyClientKeyHandle({keyHandle:G.keyHandle}).catch(()=>{return})}}catch(_){return{ok:!1,code:"internal",message:_ instanceof Error?_.message:String(_||"Failed to apply server seal")}}})().finally(()=>{t.delete(Z)});return t.set(Z,D),await D}async function K8($){let J=P($.thresholdSessionId);if(!J)return{ok:!1,code:"invalid_args",message:"Missing threshold sessionId"};let X=P($.sealedSecretB64u);if(!X)return{ok:!1,code:"invalid_args",message:"Missing sealedSecretB64u"};let Y=Math.max(0,Math.floor(Number($.remainingUses)||0)),Z=Math.max(0,Math.floor(Number($.expiresAtMs)||0));if(Y<=0)return{ok:!1,code:"exhausted",message:"Warm-session material exhausted for threshold session"};if(Z<=F())return{ok:!1,code:"expired",message:"Warm-session material expired for threshold session"};let Q=T0({operation:"remove-server-seal",thresholdSessionId:J,relayerUrl:$.transport.relayerUrl,keyVersion:$.keyVersion||$.transport.keyVersion,payloadKey:X}),D=d.get(Q);if(D)return await D;let V=(async()=>{try{let _=await n(),C=await _.createClientKeyHandle({groupId:f});try{let G=await _.addClientSealWithKeyHandle({ciphertextB64u:X,keyHandle:C.keyHandle}),q=await j0({operation:"remove-server-seal",transport:$.transport,thresholdSessionId:J,ciphertext:G,keyVersion:U($.keyVersion)||$.transport.keyVersion});if(!q.ok)return q;let N=await _.removeClientSealWithKeyHandle({ciphertextB64u:q.ciphertext,keyHandle:C.keyHandle}),W=O0({localRemainingUses:Y,localExpiresAtMs:Z,serverRemainingUses:q.remainingUses,serverExpiresAtMs:q.expiresAtMs});if(!W.ok)return W;return R0({thresholdSessionId:J,prfFirstB64u:N,remainingUses:W.remainingUses,expiresAtMs:W.expiresAtMs}),W}finally{await _.destroyClientKeyHandle({keyHandle:C.keyHandle}).catch(()=>{return})}}catch(_){return{ok:!1,code:"internal",message:_ instanceof Error?_.message:String(_||"Failed to remove server seal")}}})().finally(()=>{d.delete(Q)});return d.set(Q,V),await V}function L($,J){let X=J.success?{...typeof $==="string"&&$.trim()?{id:$.trim()}:{},success:!0,data:J.data}:{...typeof $==="string"&&$.trim()?{id:$.trim()}:{},success:!1,error:J.error};try{self.postMessage(X)}catch{}}self.onmessage=($)=>{let J=e0($.data);switch(J.kind){case"ping":L(J.id,{success:!0,data:{ok:!0}});return;case"prewarm":(async()=>{let X=await N0();L(J.id,{success:!0,data:X})})();return;case"material_put":{try{let X=J.payload;if(!X){L(J.id,{success:!0,data:{ok:!1,code:"invalid_args",message:"Invalid WARM_SESSION_MATERIAL_PUT payload"}});return}let{thresholdSessionId:Y,prfFirstB64u:Z,expiresAtMs:Q,remainingUses:D}=X;if(Q<=F()||D<=0){L(J.id,{success:!0,data:{ok:!1,code:"invalid_args",message:"Invalid expiresAtMs or remainingUses"}});return}R0({thresholdSessionId:Y,prfFirstB64u:Z,expiresAtMs:Q,remainingUses:D}),L(J.id,{success:!0,data:{ok:!0,remainingUses:D,expiresAtMs:Q}})}catch(X){let Y=X instanceof Error?X.message:String(X);L(J.id,{success:!1,error:Y})}return}case"status_read":if(!J.payload){L(J.id,{success:!1,error:"Invalid WARM_SESSION_STATUS_READ payload"});return}L(J.id,{success:!0,data:P0(J.payload.thresholdSessionId)});return;case"status_batch_read":if(!J.payload){L(J.id,{success:!1,error:"Invalid WARM_SESSION_STATUS_BATCH_READ payload"});return}L(J.id,{success:!0,data:{results:Array.from(new Set(J.payload.thresholdSessionIds)).map((X)=>({thresholdSessionId:X,result:P0(X)}))}});return;case"material_claim":if(!J.payload){L(J.id,{success:!1,error:"Invalid WARM_SESSION_MATERIAL_CLAIM payload"});return}L(J.id,{success:!0,data:L8(J.payload.thresholdSessionId,J.payload.uses,J.payload.consume)});return;case"material_consume":if(!J.payload){L(J.id,{success:!1,error:"Invalid WARM_SESSION_MATERIAL_CONSUME payload"});return}L(J.id,{success:!0,data:q8(J.payload.thresholdSessionId,J.payload.uses)});return;case"volatile_clear":{let X=r(J.payload);if(X?.scope.kind==="session")A(String(X.scope.thresholdSessionId));L(J.id,{success:!0,data:{ok:!0}});return}case"volatile_clear_all":_8(),L(J.id,{success:!0,data:{ok:!0}});return;case"seal_and_persist":(async()=>{let X=J.payload;if(!X){L(J.id,{success:!0,data:{ok:!1,code:"invalid_args",message:"Invalid WARM_SESSION_SEAL_AND_PERSIST payload"}});return}let Y=await H8(X);L(J.id,{success:!0,data:Y})})();return;case"rehydrate":(async()=>{let X=J.payload;if(!X){L(J.id,{success:!0,data:{ok:!1,code:"invalid_args",message:"Invalid WARM_SESSION_REHYDRATE payload"}});return}let Y=await K8(X);L(J.id,{success:!0,data:Y})})();return;case"unknown":if(J.id)L(J.id,{success:!1,error:`Unsupported Passkey MPC session worker message type: ${String(J.type)}`});return}};self.onerror=($)=>{console.error("[passkey-mpc-session-worker] error:",$)};self.onunhandledrejection=($)=>{console.error("[passkey-mpc-session-worker] Unhandled promise rejection:",$.reason),$.preventDefault()};
+// ../shared-ts/src/utils/domainIds.ts
+function parseDomainId(raw, fieldName) {
+  if (raw == null) {
+    return {
+      ok: false,
+      error: {
+        code: "missing",
+        message: `${fieldName} is required`
+      }
+    };
+  }
+  if (typeof raw !== "string") {
+    return {
+      ok: false,
+      error: {
+        code: "invalid",
+        message: `${fieldName} must be a string`
+      }
+    };
+  }
+  const value = raw.trim();
+  if (!value) {
+    return {
+      ok: false,
+      error: {
+        code: "missing",
+        message: `${fieldName} is required`
+      }
+    };
+  }
+  return { ok: true, value };
+}
+function parseThresholdSessionId(raw) {
+  return parseDomainId(raw, "thresholdSessionId");
+}
+
+// src/core/signingEngine/session/warmCapabilities/volatileWarmMaterialCommands.ts
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+function parseVolatileWarmSessionScope(value) {
+  const raw = asRecord(value);
+  if (!raw)
+    return null;
+  if (raw.kind === "all")
+    return { kind: "all" };
+  if (raw.kind !== "session")
+    return null;
+  const thresholdSessionId = parseThresholdSessionId(raw.thresholdSessionId);
+  if (!thresholdSessionId.ok)
+    return null;
+  return {
+    kind: "session",
+    thresholdSessionId: thresholdSessionId.value
+  };
+}
+function parseClearVolatileWarmMaterialCommand(value) {
+  const raw = asRecord(value);
+  if (!raw || raw.kind !== "clear_volatile_warm_material")
+    return null;
+  if (raw.durableRecord != null || raw.resolvedIdentity != null || raw.deleteReason != null) {
+    return null;
+  }
+  const scope = parseVolatileWarmSessionScope(raw.scope);
+  if (!scope)
+    return null;
+  return {
+    kind: "clear_volatile_warm_material",
+    scope
+  };
+}
+
+// src/core/signingEngine/chains/evm/bytes.ts
+function bytesToHex(bytes) {
+  return `0x${Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+
+// ../shared-ts/src/utils/base64.ts
+var base64Encode = (value) => {
+  const bytes = ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : new Uint8Array(value);
+  let binary = "";
+  for (let i = 0;i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+};
+var base64UrlEncode = (value) => {
+  return base64Encode(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+};
+
+// ../shared-ts/src/utils/secureRandomId.ts
+var DEFAULT_SECURE_RANDOM_ID_BYTES = 32;
+function secureRandomBytes(length = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random bytes") {
+  const byteLength = Math.max(1, Math.floor(Number(length) || 0));
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.getRandomValues !== "function") {
+    throw new Error(`WebCrypto getRandomValues is required for ${label}`);
+  }
+  return cryptoApi.getRandomValues(new Uint8Array(byteLength));
+}
+function secureRandomBase64Url(byteLength = DEFAULT_SECURE_RANDOM_ID_BYTES, label = "secure random id") {
+  return base64UrlEncode(secureRandomBytes(byteLength, label));
+}
+
+// ../shared-ts/src/utils/signingSessionSeal.ts
+var SIGNING_SESSION_SEAL_GROUP_ID = "rfc2409-group2";
+var WALLET_SESSION_SEAL_BASE_PATH = "/wallet-session/seal";
+var PASSKEY_PRF_FIRST_SALT_V1 = new Uint8Array([
+  64,
+  12,
+  49,
+  139,
+  102,
+  149,
+  151,
+  54,
+  89,
+  161,
+  105,
+  138,
+  229,
+  128,
+  223,
+  216,
+  0,
+  29,
+  153,
+  81,
+  186,
+  50,
+  198,
+  149,
+  230,
+  52,
+  153,
+  71,
+  80,
+  79,
+  63,
+  132
+]);
+var PASSKEY_PRF_SECOND_SALT_V1 = new Uint8Array([
+  38,
+  218,
+  80,
+  229,
+  172,
+  150,
+  74,
+  126,
+  160,
+  132,
+  82,
+  127,
+  182,
+  71,
+  246,
+  51,
+  11,
+  50,
+  222,
+  81,
+  169,
+  175,
+  70,
+  82,
+  75,
+  0,
+  109,
+  143,
+  127,
+  231,
+  244,
+  209
+]);
+
+// ../shared-ts/src/utils/normalize.ts
+function normalizeOptionalString(value) {
+  return typeof value === "string" ? value : "";
+}
+function normalizeOptionalTrimmedString(value) {
+  return normalizeOptionalString(value).trim();
+}
+function normalizeTrimmedString(value) {
+  return String(value ?? "").trim();
+}
+function normalizeOptionalNonEmptyString(value) {
+  const normalized = normalizeTrimmedString(value);
+  return normalized || undefined;
+}
+function normalizeFiniteNumber(value) {
+  const normalized = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(normalized))
+    return null;
+  return normalized;
+}
+function normalizeInteger(value) {
+  const normalized = normalizeFiniteNumber(value);
+  if (normalized == null)
+    return null;
+  return Math.trunc(normalized);
+}
+function normalizePositiveInteger(value) {
+  const normalized = normalizeInteger(value);
+  if (normalized == null || normalized <= 0)
+    return null;
+  return normalized;
+}
+function normalizeNonNegativeInteger(value) {
+  const normalized = normalizeInteger(value);
+  if (normalized == null || normalized < 0)
+    return null;
+  return normalized;
+}
+function stripTrailingSlashes(value) {
+  return String(value ?? "").replace(/\/+$/, "");
+}
+function ensureLeadingSlash(value) {
+  const trimmed = normalizeTrimmedString(value);
+  if (!trimmed)
+    return "";
+  return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+function joinNormalizedUrl(baseUrlRaw, pathRaw) {
+  const baseUrl = stripTrailingSlashes(normalizeTrimmedString(baseUrlRaw));
+  const path = ensureLeadingSlash(normalizeTrimmedString(pathRaw));
+  if (!baseUrl)
+    throw new Error("Missing base URL");
+  return `${baseUrl}${path}`;
+}
+
+// src/core/walletRuntimePaths/base.ts
+var W3A_WALLET_SDK_BASE_KEY = "__W3A_WALLET_SDK_BASE__";
+function getEmbeddedBase() {
+  if (typeof window === "undefined")
+    return;
+  const w = window;
+  const v = w[W3A_WALLET_SDK_BASE_KEY];
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+// src/core/walletRuntimePaths/wasm-loader.ts
+function getGlobalSelf() {
+  return typeof self !== "undefined" ? self ?? null : null;
+}
+function getGlobalLocationHref() {
+  return getGlobalSelf()?.location?.href;
+}
+function getGlobalLocationOrigin() {
+  return getGlobalSelf()?.location?.origin;
+}
+function resolveWasmUrl(wasmFilename, workerName, customBaseUrl) {
+  if (customBaseUrl) {
+    return new URL(wasmFilename, customBaseUrl);
+  }
+  if (typeof process !== "undefined" && process.env?.WASM_BASE_URL) {
+    return new URL(wasmFilename, process.env.WASM_BASE_URL);
+  }
+  const workerEnvVar = workerName.toUpperCase().replace(/[^A-Z]/g, "_") + "_WASM_BASE_URL";
+  if (typeof process !== "undefined" && process.env?.[workerEnvVar]) {
+    return new URL(wasmFilename, process.env[workerEnvVar]);
+  }
+  const globalSelf = getGlobalSelf();
+  if (globalSelf?.WASM_BASE_URL) {
+    return new URL(wasmFilename, globalSelf.WASM_BASE_URL);
+  }
+  try {
+    const embeddedBase = getEmbeddedBase();
+    if (embeddedBase) {
+      return new URL(`workers/${wasmFilename}`, embeddedBase);
+    }
+  } catch {}
+  try {
+    let metaUrl = null;
+    try {
+      metaUrl = typeof import.meta !== "undefined" && import.meta?.url ? import.meta.url : null;
+    } catch {
+      metaUrl = null;
+    }
+    if (metaUrl) {
+      const meta = new URL(metaUrl, getGlobalLocationHref());
+      if (meta.protocol === "http:" || meta.protocol === "https:") {
+        const sdkSegmentIndex = meta.pathname.indexOf("/sdk/");
+        if (sdkSegmentIndex >= 0) {
+          const sdkBasePath = meta.pathname.slice(0, sdkSegmentIndex + "/sdk/".length);
+          return new URL(`${sdkBasePath}workers/${wasmFilename}`, meta.origin);
+        }
+      }
+      return new URL(`./${wasmFilename}`, meta);
+    }
+    const baseUrl = getGlobalLocationHref() || "/";
+    return new URL(`./${wasmFilename}`, baseUrl);
+  } catch {
+    return new URL(`/sdk/workers/${wasmFilename}`, getGlobalLocationOrigin() || "/");
+  }
+}
+
+// ../../node_modules/base-x/src/esm/index.js
+function base(ALPHABET) {
+  if (ALPHABET.length >= 255) {
+    throw new TypeError("Alphabet too long");
+  }
+  const BASE_MAP = new Uint8Array(256);
+  for (let j = 0;j < BASE_MAP.length; j++) {
+    BASE_MAP[j] = 255;
+  }
+  for (let i = 0;i < ALPHABET.length; i++) {
+    const x = ALPHABET.charAt(i);
+    const xc = x.charCodeAt(0);
+    if (BASE_MAP[xc] !== 255) {
+      throw new TypeError(x + " is ambiguous");
+    }
+    BASE_MAP[xc] = i;
+  }
+  const BASE = ALPHABET.length;
+  const LEADER = ALPHABET.charAt(0);
+  const FACTOR = Math.log(BASE) / Math.log(256);
+  const iFACTOR = Math.log(256) / Math.log(BASE);
+  function encode(source) {
+    if (source instanceof Uint8Array) {} else if (ArrayBuffer.isView(source)) {
+      source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+    } else if (Array.isArray(source)) {
+      source = Uint8Array.from(source);
+    }
+    if (!(source instanceof Uint8Array)) {
+      throw new TypeError("Expected Uint8Array");
+    }
+    if (source.length === 0) {
+      return "";
+    }
+    let zeroes = 0;
+    let length = 0;
+    let pbegin = 0;
+    const pend = source.length;
+    while (pbegin !== pend && source[pbegin] === 0) {
+      pbegin++;
+      zeroes++;
+    }
+    const size = (pend - pbegin) * iFACTOR + 1 >>> 0;
+    const b58 = new Uint8Array(size);
+    while (pbegin !== pend) {
+      let carry = source[pbegin];
+      let i = 0;
+      for (let it1 = size - 1;(carry !== 0 || i < length) && it1 !== -1; it1--, i++) {
+        carry += 256 * b58[it1] >>> 0;
+        b58[it1] = carry % BASE >>> 0;
+        carry = carry / BASE >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i;
+      pbegin++;
+    }
+    let it2 = size - length;
+    while (it2 !== size && b58[it2] === 0) {
+      it2++;
+    }
+    let str = LEADER.repeat(zeroes);
+    for (;it2 < size; ++it2) {
+      str += ALPHABET.charAt(b58[it2]);
+    }
+    return str;
+  }
+  function decodeUnsafe(source) {
+    if (typeof source !== "string") {
+      throw new TypeError("Expected String");
+    }
+    if (source.length === 0) {
+      return new Uint8Array;
+    }
+    let psz = 0;
+    let zeroes = 0;
+    let length = 0;
+    while (source[psz] === LEADER) {
+      zeroes++;
+      psz++;
+    }
+    const size = (source.length - psz) * FACTOR + 1 >>> 0;
+    const b256 = new Uint8Array(size);
+    while (psz < source.length) {
+      const charCode = source.charCodeAt(psz);
+      if (charCode > 255) {
+        return;
+      }
+      let carry = BASE_MAP[charCode];
+      if (carry === 255) {
+        return;
+      }
+      let i = 0;
+      for (let it3 = size - 1;(carry !== 0 || i < length) && it3 !== -1; it3--, i++) {
+        carry += BASE * b256[it3] >>> 0;
+        b256[it3] = carry % 256 >>> 0;
+        carry = carry / 256 >>> 0;
+      }
+      if (carry !== 0) {
+        throw new Error("Non-zero carry");
+      }
+      length = i;
+      psz++;
+    }
+    let it4 = size - length;
+    while (it4 !== size && b256[it4] === 0) {
+      it4++;
+    }
+    const vch = new Uint8Array(zeroes + (size - it4));
+    let j = zeroes;
+    while (it4 !== size) {
+      vch[j++] = b256[it4++];
+    }
+    return vch;
+  }
+  function decode(string) {
+    const buffer = decodeUnsafe(string);
+    if (buffer) {
+      return buffer;
+    }
+    throw new Error("Non-base" + BASE + " character");
+  }
+  return {
+    encode,
+    decodeUnsafe,
+    decode
+  };
+}
+var esm_default = base;
+
+// ../../node_modules/bs58/src/esm/index.js
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var esm_default2 = esm_default(ALPHABET);
+
+// ../shared-ts/src/utils/validation.ts
+function requireTrimmedString(value, label, message = "is required") {
+  const parsed = normalizeOptionalTrimmedString(value);
+  if (!parsed)
+    throw new Error(`${label} ${message}`);
+  return parsed;
+}
+
+// src/core/signingEngine/workerManager/workers/shamir3pass/runtime.ts
+var runtimeSingletonPromise = null;
+var shamirWorkerSingleton = null;
+var requestCounter = 0;
+var pendingByRequestId = new Map;
+var WORKER_REQUEST_TIMEOUT_MS = 15000;
+function normalizeNonEmptyString(input, label) {
+  return requireTrimmedString(input, label, "must be a non-empty string");
+}
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function normalizeClientKeyHandle(value) {
+  if (!isObjectRecord(value)) {
+    throw new Error("Invalid Shamir3Pass key handle response");
+  }
+  return {
+    keyHandle: normalizeNonEmptyString(value.keyHandle, "keyHandle")
+  };
+}
+function toWorkerError(response) {
+  const code = String(response.code || "").trim();
+  const message = normalizeNonEmptyString(response.error, "error");
+  return new Error(code ? `[shamir3pass-worker] ${code}: ${message}` : `[shamir3pass-worker] ${message}`);
+}
+function normalizeWorkerResponse(value) {
+  if (!isObjectRecord(value))
+    return null;
+  const id = String(value.id || "").trim();
+  if (!id || typeof value.ok !== "boolean")
+    return null;
+  if (value.ok) {
+    return { id, ok: true, result: value.result };
+  }
+  return {
+    id,
+    ok: false,
+    error: String(value.error || "Worker request failed"),
+    ...String(value.code || "").trim() ? { code: String(value.code).trim() } : {}
+  };
+}
+function nextRequestId() {
+  requestCounter += 1;
+  return `shamir3pass-${Date.now()}-${requestCounter}`;
+}
+function rejectAllPending(reason) {
+  const pending = Array.from(pendingByRequestId.values());
+  pendingByRequestId.clear();
+  for (const entry of pending) {
+    clearTimeout(entry.timeoutId);
+    try {
+      entry.reject(new Error(reason));
+    } catch {}
+  }
+}
+function resetWorker(reason) {
+  const worker = shamirWorkerSingleton;
+  shamirWorkerSingleton = null;
+  if (worker) {
+    try {
+      worker.terminate();
+    } catch {}
+  }
+  rejectAllPending(reason);
+}
+function resolveWorkerConstructor() {
+  const workerCtor = globalThis.Worker;
+  if (typeof workerCtor !== "function") {
+    throw new Error("Shamir3Pass worker is unavailable in this runtime");
+  }
+  return workerCtor;
+}
+function getOrCreateShamirWorker() {
+  if (shamirWorkerSingleton)
+    return shamirWorkerSingleton;
+  const WorkerCtor = resolveWorkerConstructor();
+  const workerUrl = resolveWasmUrl("shamir3pass.worker.js", "Shamir3Pass Worker");
+  const worker = new WorkerCtor(workerUrl, { type: "module", name: "shamir3pass-worker" });
+  worker.onmessage = (event) => {
+    const parsed = normalizeWorkerResponse(event.data);
+    if (!parsed)
+      return;
+    const pending = pendingByRequestId.get(parsed.id);
+    if (!pending)
+      return;
+    pendingByRequestId.delete(parsed.id);
+    clearTimeout(pending.timeoutId);
+    if (parsed.ok) {
+      pending.resolve(parsed.result);
+      return;
+    }
+    pending.reject(toWorkerError(parsed));
+  };
+  worker.onerror = (event) => {
+    const message = String(event?.message || "Unknown worker error").trim();
+    resetWorker(`[shamir3pass-worker] ${message || "Worker crashed"}`);
+  };
+  worker.onmessageerror = () => {
+    resetWorker("[shamir3pass-worker] Failed to deserialize worker message");
+  };
+  shamirWorkerSingleton = worker;
+  return worker;
+}
+function sendWorkerRequest(type, payload, transfer) {
+  const requestId = nextRequestId();
+  const worker = getOrCreateShamirWorker();
+  return new Promise((resolve, reject) => {
+    const timeoutId = setTimeout(() => {
+      pendingByRequestId.delete(requestId);
+      reject(new Error(`[shamir3pass-worker] Request timed out after ${WORKER_REQUEST_TIMEOUT_MS}ms`));
+    }, WORKER_REQUEST_TIMEOUT_MS);
+    pendingByRequestId.set(requestId, {
+      resolve,
+      reject,
+      timeoutId
+    });
+    const request = {
+      id: requestId,
+      type,
+      payload
+    };
+    try {
+      worker.postMessage(request, transfer || []);
+    } catch (error) {
+      const pending = pendingByRequestId.get(requestId);
+      if (pending) {
+        pendingByRequestId.delete(requestId);
+        clearTimeout(pending.timeoutId);
+      }
+      reject(error instanceof Error ? error : new Error(String(error || "Worker postMessage failed")));
+    }
+  });
+}
+function createShamir3PassRuntime() {
+  return {
+    createClientKeyHandle: async ({ groupId }) => normalizeClientKeyHandle(await sendWorkerRequest("createClientKeyHandle", {
+      groupId
+    })),
+    destroyClientKeyHandle: async ({ keyHandle }) => {
+      await sendWorkerRequest("destroyClientKeyHandle", {
+        keyHandle
+      });
+    },
+    addClientSealWithKeyHandle: async ({ ciphertextB64u, keyHandle }) => normalizeNonEmptyString(await sendWorkerRequest("addClientSealWithKeyHandle", {
+      ciphertextB64u,
+      keyHandle
+    }), "ciphertextB64u"),
+    addClientSealBytesWithKeyHandle: async ({ ciphertext, keyHandle }) => {
+      const ciphertextCopy = ciphertext.slice();
+      return normalizeNonEmptyString(await sendWorkerRequest("addClientSealBytesWithKeyHandle", {
+        ciphertext: ciphertextCopy.buffer,
+        keyHandle
+      }, [ciphertextCopy.buffer]), "ciphertextB64u");
+    },
+    removeClientSealWithKeyHandle: async ({ ciphertextB64u, keyHandle }) => normalizeNonEmptyString(await sendWorkerRequest("removeClientSealWithKeyHandle", {
+      ciphertextB64u,
+      keyHandle
+    }), "ciphertextB64u"),
+    removeClientSealWithKeyHandleToBytes: async ({ ciphertextB64u, keyHandle }) => {
+      const result = await sendWorkerRequest("removeClientSealWithKeyHandleToBytes", {
+        ciphertextB64u,
+        keyHandle
+      });
+      if (!(result instanceof ArrayBuffer)) {
+        throw new Error("ciphertext bytes response must be an ArrayBuffer");
+      }
+      return new Uint8Array(result);
+    }
+  };
+}
+async function warmupShamir3PassRuntime() {
+  const startedAt = performance.now();
+  try {
+    await sendWorkerRequest("warmup", {});
+    return { kind: "succeeded", elapsedMs: Math.max(0, Math.round(performance.now() - startedAt)) };
+  } catch {
+    return { kind: "failed", elapsedMs: Math.max(0, Math.round(performance.now() - startedAt)) };
+  }
+}
+async function getShamir3PassRuntime() {
+  if (!runtimeSingletonPromise) {
+    runtimeSingletonPromise = Promise.resolve(createShamir3PassRuntime()).catch((error) => {
+      runtimeSingletonPromise = null;
+      throw error;
+    });
+  }
+  return runtimeSingletonPromise;
+}
+
+// src/core/signingEngine/workerManager/workers/passkey-mpc-session.worker.ts
+var PASSKEY_SERVER_SEALED_SECRET_CACHE_MAX_ENTRIES = 32;
+var warmSessionPrfHandleCache = new Map;
+var passkeyPrfFirstHandleStore = new Map;
+var passkeyServerSealedSecretCache = new Map;
+var signingSessionSealApplyInFlight = new Map;
+var signingSessionSealRemoveInFlight = new Map;
+var SIGNING_SESSION_SEAL_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
+var SIGNING_SESSION_SEAL_ROUTE_TIMEOUT_MS = 15000;
+function abortSigningSessionSealRoute(controller) {
+  controller.abort("timeout");
+}
+function parseSessionMessageId(value) {
+  return typeof value === "string" ? normalizeOptionalTrimmedString(value) || undefined : undefined;
+}
+function parseSessionString(value) {
+  if (typeof value !== "string")
+    return null;
+  return normalizeOptionalTrimmedString(value) || null;
+}
+function parseSessionInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
+}
+function parseSessionStringArray(value) {
+  if (!Array.isArray(value))
+    return null;
+  const keys = Object.keys(value);
+  if (keys.length !== value.length || keys.some((key) => !/^\d+$/.test(key)))
+    return null;
+  const output = [];
+  for (let index = 0;index < value.length; index += 1) {
+    const parsed = parseSessionString(value[index]);
+    if (!parsed)
+      return null;
+    output.push(parsed);
+  }
+  return output;
+}
+function parseWarmSessionMaterialPutPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.some((field) => ![
+    "thresholdSessionId",
+    "prfFirstB64u",
+    "expiresAtMs",
+    "remainingUses",
+    "transport"
+  ].includes(field)) || !["thresholdSessionId", "prfFirstB64u", "expiresAtMs", "remainingUses"].every((field) => fields.includes(field))) {
+    return null;
+  }
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  const prfFirstB64u = parseSessionString(Reflect.get(value, "prfFirstB64u"));
+  const expiresAtMs = parseSessionInteger(Reflect.get(value, "expiresAtMs"));
+  const remainingUses = parseSessionInteger(Reflect.get(value, "remainingUses"));
+  const hasTransport = fields.includes("transport");
+  const transport = hasTransport ? parseSigningSessionSealTransport(Reflect.get(value, "transport")) : undefined;
+  if (!thresholdSessionId || !prfFirstB64u || expiresAtMs === null || remainingUses === null || hasTransport && !transport) {
+    return null;
+  }
+  return {
+    thresholdSessionId,
+    prfFirstB64u,
+    expiresAtMs,
+    remainingUses,
+    ...transport ? { transport } : {}
+  };
+}
+function parseWarmSessionStatusReadPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.length !== 1 || fields[0] !== "thresholdSessionId")
+    return null;
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  return thresholdSessionId ? { thresholdSessionId } : null;
+}
+function parseWarmSessionStatusBatchReadPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.length !== 1 || fields[0] !== "thresholdSessionIds")
+    return null;
+  const thresholdSessionIds = parseSessionStringArray(Reflect.get(value, "thresholdSessionIds"));
+  return thresholdSessionIds ? { thresholdSessionIds } : null;
+}
+function parseWarmSessionMaterialClaimPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.some((field) => !["thresholdSessionId", "uses", "consume", "curve"].includes(field)) || !fields.includes("thresholdSessionId")) {
+    return null;
+  }
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  const hasUses = fields.includes("uses");
+  const uses = hasUses ? parseSessionInteger(Reflect.get(value, "uses")) : 1;
+  const hasConsume = fields.includes("consume");
+  const consume = hasConsume ? Reflect.get(value, "consume") : true;
+  const hasCurve = fields.includes("curve");
+  const curve = hasCurve ? Reflect.get(value, "curve") : undefined;
+  if (!thresholdSessionId || uses === null || uses < 1 || typeof consume !== "boolean" || curve !== undefined && curve !== "ed25519" && curve !== "ecdsa") {
+    return null;
+  }
+  return {
+    thresholdSessionId,
+    uses,
+    consume,
+    ...curve !== undefined ? { curve } : {}
+  };
+}
+function parseWarmSessionMaterialConsumePayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.some((field) => !["thresholdSessionId", "uses", "curve"].includes(field)) || !fields.includes("thresholdSessionId")) {
+    return null;
+  }
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  const hasUses = fields.includes("uses");
+  const uses = hasUses ? parseSessionInteger(Reflect.get(value, "uses")) : 1;
+  const hasCurve = fields.includes("curve");
+  const curve = hasCurve ? Reflect.get(value, "curve") : undefined;
+  if (!thresholdSessionId || uses === null || uses < 1 || curve !== undefined && curve !== "ed25519" && curve !== "ecdsa") {
+    return null;
+  }
+  return {
+    thresholdSessionId,
+    uses,
+    ...curve !== undefined ? { curve } : {}
+  };
+}
+function parseWarmSessionSealAndPersistPayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  if (fields.length !== 2 || !fields.includes("thresholdSessionId") || !fields.includes("transport")) {
+    return null;
+  }
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  const transport = parseSigningSessionSealTransport(Reflect.get(value, "transport"));
+  return thresholdSessionId && transport ? { thresholdSessionId, transport } : null;
+}
+function parseWarmSessionRehydratePayload(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const fields = Object.keys(value);
+  const requiredFields = [
+    "thresholdSessionId",
+    "sealedSecretB64u",
+    "expiresAtMs",
+    "remainingUses",
+    "transport"
+  ];
+  if (fields.some((field) => ![...requiredFields, "signingSessionSealKeyVersion"].includes(field)) || requiredFields.some((field) => !fields.includes(field))) {
+    return null;
+  }
+  const thresholdSessionId = parseSessionString(Reflect.get(value, "thresholdSessionId"));
+  const sealedSecretB64u = parseSessionString(Reflect.get(value, "sealedSecretB64u"));
+  const expiresAtMs = parseSessionInteger(Reflect.get(value, "expiresAtMs"));
+  const remainingUses = parseSessionInteger(Reflect.get(value, "remainingUses"));
+  const transport = parseSigningSessionSealTransport(Reflect.get(value, "transport"));
+  const hasKeyVersion = fields.includes("signingSessionSealKeyVersion");
+  const keyVersion = hasKeyVersion ? parseSessionString(Reflect.get(value, "signingSessionSealKeyVersion")) : undefined;
+  if (!thresholdSessionId || !sealedSecretB64u || expiresAtMs === null || remainingUses === null || !transport || hasKeyVersion && !keyVersion) {
+    return null;
+  }
+  return {
+    thresholdSessionId,
+    sealedSecretB64u,
+    expiresAtMs,
+    remainingUses,
+    ...keyVersion ? { keyVersion } : {},
+    transport
+  };
+}
+function parsePasskeyMpcSessionWorkerMessage(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "unknown", type: undefined };
+  }
+  const fields = Object.keys(value);
+  if (fields.some((field) => !["id", "type", "payload"].includes(field)) || !fields.includes("type")) {
+    return { kind: "unknown", type: Reflect.get(value, "type") };
+  }
+  const id = fields.includes("id") ? parseSessionMessageId(Reflect.get(value, "id")) : undefined;
+  if (fields.includes("id") && id === undefined) {
+    return { kind: "unknown", type: Reflect.get(value, "type") };
+  }
+  const type = Reflect.get(value, "type");
+  const hasPayload = fields.includes("payload");
+  const payload = hasPayload ? Reflect.get(value, "payload") : undefined;
+  switch (type) {
+    case "PING":
+      return fields.length === (fields.includes("id") ? 2 : 1) ? { kind: "ping", ...id ? { id } : {} } : { kind: "unknown", id, type };
+    case "PREWARM_SHAMIR3PASS":
+      if (!hasPayload || payload === null || typeof payload !== "object" || Array.isArray(payload)) {
+        return { kind: "unknown", id, type };
+      }
+      if (Object.keys(payload).length !== 0)
+        return { kind: "unknown", id, type };
+      return { kind: "prewarm", ...id ? { id } : {} };
+    case "WARM_SESSION_MATERIAL_PUT":
+      return {
+        kind: "material_put",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionMaterialPutPayload(payload) : null
+      };
+    case "WARM_SESSION_STATUS_READ":
+      return {
+        kind: "status_read",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionStatusReadPayload(payload) : null
+      };
+    case "WARM_SESSION_STATUS_BATCH_READ":
+      return {
+        kind: "status_batch_read",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionStatusBatchReadPayload(payload) : null
+      };
+    case "WARM_SESSION_MATERIAL_CLAIM":
+      return {
+        kind: "material_claim",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionMaterialClaimPayload(payload) : null
+      };
+    case "WARM_SESSION_MATERIAL_CONSUME":
+      return {
+        kind: "material_consume",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionMaterialConsumePayload(payload) : null
+      };
+    case "WARM_SESSION_VOLATILE_MATERIAL_CLEAR":
+      return hasPayload ? { kind: "volatile_clear", ...id ? { id } : {}, payload } : { kind: "unknown", id, type };
+    case "WARM_SESSION_VOLATILE_MATERIAL_CLEAR_ALL":
+      return hasPayload ? { kind: "volatile_clear_all", ...id ? { id } : {}, payload } : { kind: "unknown", id, type };
+    case "WARM_SESSION_SEAL_AND_PERSIST":
+      return {
+        kind: "seal_and_persist",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionSealAndPersistPayload(payload) : null
+      };
+    case "WARM_SESSION_REHYDRATE":
+      return {
+        kind: "rehydrate",
+        ...id ? { id } : {},
+        payload: hasPayload ? parseWarmSessionRehydratePayload(payload) : null
+      };
+    default:
+      return { kind: "unknown", id, type };
+  }
+}
+function nowMs() {
+  return Date.now();
+}
+function roundWorkerDurationMs(startedAt) {
+  return Math.max(0, Math.round(performance.now() - startedAt));
+}
+function createWarmSessionSealAndPersistDiagnostics() {
+  return {
+    runtimeSetupMs: 0,
+    clientSealMs: 0,
+    serverSealRouteMs: 0,
+    clientUnsealMs: 0,
+    policyUpdateMs: 0
+  };
+}
+function recordWarmSessionSealAndPersistDiagnosticDuration(args) {
+  args.diagnostics[args.bucket] += roundWorkerDurationMs(args.startedAt);
+}
+function toSessionId(prefix) {
+  const value = String(prefix || "").trim() || "session";
+  return `${value}:${secureRandomBase64Url(32, "passkey confirm worker session IDs")}`;
+}
+function createPasskeyPrfFirstHandle(args) {
+  const prfFirstB64u = normalizeOptionalTrimmedString(args.prfFirstB64u);
+  const expiresAtMs = Math.floor(Number(args.expiresAtMs) || 0);
+  if (!prfFirstB64u || expiresAtMs <= nowMs()) {
+    throw new Error("Invalid passkey PRF material handle input");
+  }
+  const prfFirstHandle = toSessionId("passkey-prf-first");
+  passkeyPrfFirstHandleStore.set(prfFirstHandle, {
+    prfFirstB64u,
+    expiresAtMs
+  });
+  return prfFirstHandle;
+}
+async function sha256HexUtf8(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return bytesToHex(new Uint8Array(digest));
+}
+async function passkeyServerSealedSecretCacheKey(args) {
+  const prfFirstB64u = normalizeOptionalTrimmedString(args.prfFirstB64u);
+  const relayerUrl = normalizeOptionalTrimmedString(args.relayerUrl);
+  const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion);
+  const cacheScope = args.cacheScope;
+  if (!prfFirstB64u || !relayerUrl || !keyVersion || !cacheScope)
+    return null;
+  const prfDigestHex = await sha256HexUtf8(prfFirstB64u);
+  return [
+    "passkey-server-sealed-secret-v1",
+    relayerUrl,
+    keyVersion,
+    SIGNING_SESSION_SEAL_GROUP_ID,
+    cacheScope.walletId,
+    cacheScope.credentialIdB64u,
+    cacheScope.walletSessionId,
+    cacheScope.quotaId,
+    prfDigestHex
+  ].join("|");
+}
+function prunePasskeyServerSealedSecretCache() {
+  const now = nowMs();
+  for (const [key, entry] of passkeyServerSealedSecretCache) {
+    if (entry.expiresAtMs <= now)
+      passkeyServerSealedSecretCache.delete(key);
+  }
+  while (passkeyServerSealedSecretCache.size > PASSKEY_SERVER_SEALED_SECRET_CACHE_MAX_ENTRIES) {
+    const firstKey = passkeyServerSealedSecretCache.keys().next().value;
+    if (typeof firstKey !== "string")
+      return;
+    passkeyServerSealedSecretCache.delete(firstKey);
+  }
+}
+function readPasskeyServerSealedSecretCache(cacheKey) {
+  if (!cacheKey)
+    return null;
+  prunePasskeyServerSealedSecretCache();
+  const entry = passkeyServerSealedSecretCache.get(cacheKey);
+  if (!entry || entry.expiresAtMs <= nowMs()) {
+    if (entry)
+      passkeyServerSealedSecretCache.delete(cacheKey);
+    return null;
+  }
+  return entry;
+}
+function writePasskeyServerSealedSecretCache(args) {
+  if (!args.cacheKey)
+    return;
+  const sealedSecretB64u = normalizeOptionalTrimmedString(args.sealedSecretB64u);
+  const expiresAtMs = Math.floor(Number(args.expiresAtMs) || 0);
+  if (!sealedSecretB64u || expiresAtMs <= nowMs())
+    return;
+  passkeyServerSealedSecretCache.set(args.cacheKey, { sealedSecretB64u, expiresAtMs });
+  prunePasskeyServerSealedSecretCache();
+}
+function deleteWarmSessionPrfHandle(thresholdSessionId) {
+  const entry = warmSessionPrfHandleCache.get(thresholdSessionId);
+  if (entry)
+    passkeyPrfFirstHandleStore.delete(entry.prfFirstHandle);
+  warmSessionPrfHandleCache.delete(thresholdSessionId);
+}
+function clearWarmSessionPrfHandles() {
+  warmSessionPrfHandleCache.clear();
+  passkeyPrfFirstHandleStore.clear();
+  passkeyServerSealedSecretCache.clear();
+}
+function storeWarmSessionPrfHandle(args) {
+  const thresholdSessionId = normalizeOptionalTrimmedString(args.thresholdSessionId);
+  const remainingUses = Math.floor(Number(args.remainingUses) || 0);
+  const expiresAtMs = Math.floor(Number(args.expiresAtMs) || 0);
+  if (!thresholdSessionId || remainingUses <= 0 || expiresAtMs <= nowMs()) {
+    throw new Error("Invalid warm-session PRF handle input");
+  }
+  deleteWarmSessionPrfHandle(thresholdSessionId);
+  const prfFirstHandle = createPasskeyPrfFirstHandle({
+    prfFirstB64u: args.prfFirstB64u,
+    expiresAtMs
+  });
+  const entry = { prfFirstHandle, expiresAtMs, remainingUses };
+  warmSessionPrfHandleCache.set(thresholdSessionId, entry);
+  return entry;
+}
+function updateWarmSessionPrfHandlePolicy(thresholdSessionId, entry, policy) {
+  const nextEntry = {
+    prfFirstHandle: entry.prfFirstHandle,
+    remainingUses: policy.remainingUses,
+    expiresAtMs: policy.expiresAtMs
+  };
+  const secret = passkeyPrfFirstHandleStore.get(entry.prfFirstHandle);
+  if (secret) {
+    passkeyPrfFirstHandleStore.set(entry.prfFirstHandle, {
+      prfFirstB64u: secret.prfFirstB64u,
+      expiresAtMs: policy.expiresAtMs
+    });
+  }
+  warmSessionPrfHandleCache.set(thresholdSessionId, nextEntry);
+  return nextEntry;
+}
+function parseSigningSessionSealTransport(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const curve = Reflect.get(value, "curve");
+  const authMethod = Reflect.get(value, "authMethod");
+  const requiredFields = curve === "ed25519" ? ["curve", "authMethod", "walletId", "relayerUrl", "walletSessionToken", "ed25519Restore"] : curve === "ecdsa" ? [
+    "curve",
+    "authMethod",
+    "walletId",
+    "chainTarget",
+    "relayerUrl",
+    "walletSessionToken",
+    "ecdsaRestore"
+  ] : [];
+  const optionalFields = [
+    "signingSessionSealKeyVersion",
+    "groupId",
+    "serverSealedSecretCacheScope"
+  ];
+  const fields = Object.keys(value);
+  if (curve !== "ed25519" && curve !== "ecdsa" || authMethod !== "passkey" || fields.some((field) => ![...requiredFields, ...optionalFields].includes(field)) || requiredFields.some((field) => !fields.includes(field))) {
+    return null;
+  }
+  const walletId = parseSessionString(Reflect.get(value, "walletId"));
+  const relayerUrl = normalizeOptionalNonEmptyString(Reflect.get(value, "relayerUrl"));
+  const walletSessionToken = normalizeOptionalNonEmptyString(Reflect.get(value, "walletSessionToken"));
+  const restore = Reflect.get(value, curve === "ed25519" ? "ed25519Restore" : "ecdsaRestore");
+  const chainTarget = curve === "ecdsa" ? Reflect.get(value, "chainTarget") : undefined;
+  const rawKeyVersion = Reflect.get(value, "signingSessionSealKeyVersion");
+  const hasKeyVersion = fields.includes("signingSessionSealKeyVersion");
+  const keyVersion = normalizeOptionalNonEmptyString(rawKeyVersion);
+  const hasCacheScope = fields.includes("serverSealedSecretCacheScope");
+  const serverSealedSecretCacheScope = parsePasskeyServerSealedSecretCacheScope(Reflect.get(value, "serverSealedSecretCacheScope"));
+  if (!walletId || !relayerUrl || !walletSessionToken || restore === null || typeof restore !== "object" || Array.isArray(restore) || curve === "ecdsa" && (chainTarget === null || typeof chainTarget !== "object" || Array.isArray(chainTarget)) || hasKeyVersion && !keyVersion || hasCacheScope && !serverSealedSecretCacheScope) {
+    return null;
+  }
+  return {
+    relayerUrl,
+    walletSessionToken,
+    ...hasKeyVersion && keyVersion ? { keyVersion } : {},
+    ...serverSealedSecretCacheScope ? { serverSealedSecretCacheScope } : {}
+  };
+}
+function parsePasskeyServerSealedSecretCacheScope(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return;
+  const fields = Object.keys(value);
+  if (fields.length !== 5 || !["kind", "walletId", "credentialIdB64u", "walletSessionId", "quotaId"].every((field) => fields.includes(field)) || Reflect.get(value, "kind") !== "passkey_registration") {
+    return;
+  }
+  const walletId = normalizeOptionalNonEmptyString(Reflect.get(value, "walletId"));
+  const credentialIdB64u = normalizeOptionalNonEmptyString(Reflect.get(value, "credentialIdB64u"));
+  const walletSessionId = normalizeOptionalNonEmptyString(Reflect.get(value, "walletSessionId"));
+  const quotaId = normalizeOptionalNonEmptyString(Reflect.get(value, "quotaId"));
+  if (!walletId || !credentialIdB64u || !walletSessionId || !quotaId)
+    return;
+  return {
+    kind: "passkey_registration",
+    walletId,
+    credentialIdB64u,
+    walletSessionId,
+    quotaId
+  };
+}
+function parseSigningSessionSealRouteResult(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return {
+      ok: false,
+      code: "invalid_response",
+      message: "Invalid signing-session seal response"
+    };
+  }
+  const ok = Reflect.get(value, "ok");
+  if (typeof ok !== "boolean") {
+    return {
+      ok: false,
+      code: "invalid_response",
+      message: "Invalid signing-session seal response"
+    };
+  }
+  const fields = Object.keys(value);
+  const allowedFields = ok ? ["ok", "ciphertext", "keyVersion", "expiresAtMs", "remainingUses"] : ["ok", "code", "message"];
+  if (fields.some((field) => !allowedFields.includes(field))) {
+    return {
+      ok: false,
+      code: "invalid_response",
+      message: "Invalid signing-session seal response"
+    };
+  }
+  if (!ok) {
+    const code = Reflect.get(value, "code");
+    const message = Reflect.get(value, "message");
+    return {
+      ok: false,
+      code: typeof code === "string" ? code : "request_failed",
+      message: typeof message === "string" ? message : "Signing-session seal request failed"
+    };
+  }
+  const ciphertext = normalizeOptionalTrimmedString(Reflect.get(value, "ciphertext"));
+  const keyVersion = normalizeOptionalNonEmptyString(Reflect.get(value, "keyVersion"));
+  const expiresAtMs = normalizePositiveInteger(Reflect.get(value, "expiresAtMs"));
+  const remainingUses = normalizeNonNegativeInteger(Reflect.get(value, "remainingUses"));
+  if (!ciphertext) {
+    return {
+      ok: false,
+      code: "invalid_response",
+      message: "Missing ciphertext in signing-session seal response"
+    };
+  }
+  return {
+    ok: true,
+    ciphertext,
+    ...keyVersion ? { keyVersion } : {},
+    ...expiresAtMs != null ? { expiresAtMs } : {},
+    ...remainingUses != null ? { remainingUses } : {}
+  };
+}
+function makeSigningSessionSealSingleFlightKey(args) {
+  const operation = args.operation === "apply-server-seal" ? "apply-server-seal" : "remove-server-seal";
+  const thresholdSessionId = normalizeOptionalTrimmedString(args.thresholdSessionId) || "";
+  const relayerUrl = normalizeOptionalTrimmedString(args.relayerUrl) || "";
+  const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion) || "";
+  const payloadKey = normalizeOptionalNonEmptyString(args.payloadKey) || "";
+  return `${operation}|${thresholdSessionId}|${relayerUrl}|${keyVersion}|${SIGNING_SESSION_SEAL_GROUP_ID}|${payloadKey}`;
+}
+async function callSigningSessionSealRoute(args) {
+  const routePath = args.operation === "apply-server-seal" ? "apply-server-seal" : "remove-server-seal";
+  const url = joinNormalizedUrl(args.transport.relayerUrl, `${SIGNING_SESSION_SEAL_BASE_PATH}/${routePath}`);
+  const controller = new AbortController;
+  const timeoutId = setTimeout(abortSigningSessionSealRoute, SIGNING_SESSION_SEAL_ROUTE_TIMEOUT_MS, controller);
+  try {
+    const headers = {
+      "Content-Type": "application/json"
+    };
+    const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion);
+    headers.Authorization = `Bearer ${args.transport.walletSessionToken}`;
+    const response = await fetch(url, {
+      method: "POST",
+      credentials: "omit",
+      headers,
+      signal: controller.signal,
+      body: JSON.stringify({
+        thresholdSessionId: args.thresholdSessionId,
+        ciphertext: args.ciphertext,
+        ...keyVersion ? { keyVersion } : {}
+      })
+    });
+    const data = await response.json().catch(() => null);
+    const parsed = parseSigningSessionSealRouteResult(data);
+    if (!response.ok && parsed.ok) {
+      return {
+        ok: false,
+        code: "http_error",
+        message: `Signing-session seal route returned HTTP ${response.status}`
+      };
+    }
+    if (!parsed.ok)
+      return parsed;
+    return parsed;
+  } catch (error) {
+    return {
+      ok: false,
+      code: controller.signal.aborted ? "timeout" : "network_error",
+      message: controller.signal.aborted ? `Signing-session seal request timed out after ${SIGNING_SESSION_SEAL_ROUTE_TIMEOUT_MS}ms` : error instanceof Error ? error.message : String(error || "Signing-session seal request failed")
+    };
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function resolvePolicyFromServerAndLocal(args) {
+  const localRemainingUses = Math.max(0, Math.floor(Number(args.localRemainingUses) || 0));
+  const localExpiresAtMs = Math.max(0, Math.floor(Number(args.localExpiresAtMs) || 0));
+  const serverRemainingUses = normalizeNonNegativeInteger(args.serverRemainingUses) ?? localRemainingUses;
+  const serverExpiresAtMs = normalizePositiveInteger(args.serverExpiresAtMs) || localExpiresAtMs;
+  const remainingUses = Math.min(localRemainingUses, serverRemainingUses);
+  const expiresAtMs = Math.min(localExpiresAtMs, serverExpiresAtMs);
+  if (remainingUses <= 0) {
+    return {
+      ok: false,
+      code: "exhausted",
+      message: "Warm-session material exhausted for threshold session"
+    };
+  }
+  if (expiresAtMs <= nowMs()) {
+    return {
+      ok: false,
+      code: "expired",
+      message: "Warm-session material expired for threshold session"
+    };
+  }
+  return { ok: true, remainingUses, expiresAtMs };
+}
+function readWarmSessionMaterialEntry(thresholdSessionId) {
+  if (!thresholdSessionId)
+    return { ok: false, code: "invalid_args", message: "Missing threshold sessionId" };
+  const entry = warmSessionPrfHandleCache.get(thresholdSessionId);
+  if (!entry)
+    return {
+      ok: false,
+      code: "not_found",
+      message: "Warm-session material is not available for threshold session"
+    };
+  if (nowMs() >= entry.expiresAtMs) {
+    deleteWarmSessionPrfHandle(thresholdSessionId);
+    return {
+      ok: false,
+      code: "expired",
+      message: "Warm-session material expired for threshold session"
+    };
+  }
+  if (entry.remainingUses <= 0) {
+    deleteWarmSessionPrfHandle(thresholdSessionId);
+    return {
+      ok: false,
+      code: "exhausted",
+      message: "Warm-session material exhausted for threshold session"
+    };
+  }
+  const secret = passkeyPrfFirstHandleStore.get(entry.prfFirstHandle);
+  if (!secret || nowMs() >= secret.expiresAtMs) {
+    deleteWarmSessionPrfHandle(thresholdSessionId);
+    return {
+      ok: false,
+      code: "not_found",
+      message: "Warm-session material handle is not available for threshold session"
+    };
+  }
+  return {
+    ok: true,
+    entry,
+    secret,
+    remainingUses: entry.remainingUses,
+    expiresAtMs: entry.expiresAtMs
+  };
+}
+function readWarmSessionClaimEntry(thresholdSessionId) {
+  const activeEntry = readWarmSessionMaterialEntry(thresholdSessionId);
+  if (!activeEntry.ok)
+    return activeEntry;
+  return {
+    ok: true,
+    remainingUses: activeEntry.remainingUses,
+    expiresAtMs: activeEntry.expiresAtMs
+  };
+}
+function claimWarmSessionMaterialEntry(thresholdSessionId, uses, consume) {
+  const activeEntry = readWarmSessionMaterialEntry(thresholdSessionId);
+  if (!activeEntry.ok)
+    return activeEntry;
+  const entry = activeEntry.entry;
+  const usesNeeded = Math.max(1, Math.floor(Number(uses) || 1));
+  if (entry.remainingUses < usesNeeded) {
+    return {
+      ok: false,
+      code: "exhausted",
+      message: "Warm-session material exhausted for threshold session"
+    };
+  }
+  if (consume) {
+    entry.remainingUses -= usesNeeded;
+    if (entry.remainingUses <= 0) {
+      deleteWarmSessionPrfHandle(thresholdSessionId);
+    } else {
+      warmSessionPrfHandleCache.set(thresholdSessionId, entry);
+    }
+  }
+  return {
+    ok: true,
+    prfFirstB64u: activeEntry.secret.prfFirstB64u,
+    remainingUses: entry.remainingUses,
+    expiresAtMs: entry.expiresAtMs
+  };
+}
+function consumeWarmSessionMaterialEntry(thresholdSessionId, uses) {
+  const activeEntry = readWarmSessionMaterialEntry(thresholdSessionId);
+  if (!activeEntry.ok)
+    return activeEntry;
+  const entry = activeEntry.entry;
+  const usesNeeded = Math.max(1, Math.floor(Number(uses) || 1));
+  if (entry.remainingUses < usesNeeded) {
+    return {
+      ok: false,
+      code: "exhausted",
+      message: "Warm-session material exhausted for threshold session"
+    };
+  }
+  entry.remainingUses -= usesNeeded;
+  if (entry.remainingUses <= 0) {
+    deleteWarmSessionPrfHandle(thresholdSessionId);
+  } else {
+    warmSessionPrfHandleCache.set(thresholdSessionId, entry);
+  }
+  return {
+    ok: true,
+    remainingUses: entry.remainingUses,
+    expiresAtMs: entry.expiresAtMs
+  };
+}
+async function runSigningSessionSealAndPersist(args) {
+  const thresholdSessionId = normalizeOptionalTrimmedString(args.thresholdSessionId);
+  if (!thresholdSessionId) {
+    return { ok: false, code: "invalid_args", message: "Missing threshold sessionId" };
+  }
+  const activeEntry = readWarmSessionMaterialEntry(thresholdSessionId);
+  if (!activeEntry.ok)
+    return activeEntry;
+  const entry = activeEntry.entry;
+  const singleFlightKey = makeSigningSessionSealSingleFlightKey({
+    operation: "apply-server-seal",
+    thresholdSessionId,
+    relayerUrl: args.transport.relayerUrl,
+    keyVersion: args.transport.keyVersion,
+    payloadKey: entry.prfFirstHandle
+  });
+  const inFlight = signingSessionSealApplyInFlight.get(singleFlightKey);
+  if (inFlight)
+    return await inFlight;
+  const task = (async () => {
+    const diagnostics = createWarmSessionSealAndPersistDiagnostics();
+    try {
+      const runtimeSetupStartedAt = performance.now();
+      const runtime = await getShamir3PassRuntime();
+      const clientKeyHandle = await runtime.createClientKeyHandle({
+        groupId: SIGNING_SESSION_SEAL_GROUP_ID
+      });
+      recordWarmSessionSealAndPersistDiagnosticDuration({
+        diagnostics,
+        bucket: "runtimeSetupMs",
+        startedAt: runtimeSetupStartedAt
+      });
+      try {
+        const clientSealStartedAt = performance.now();
+        const clientEncryptedCiphertext = await runtime.addClientSealWithKeyHandle({
+          ciphertextB64u: activeEntry.secret.prfFirstB64u,
+          keyHandle: clientKeyHandle.keyHandle
+        });
+        recordWarmSessionSealAndPersistDiagnosticDuration({
+          diagnostics,
+          bucket: "clientSealMs",
+          startedAt: clientSealStartedAt
+        });
+        const serverSealRouteStartedAt = performance.now();
+        const applied = await callSigningSessionSealRoute({
+          operation: "apply-server-seal",
+          transport: args.transport,
+          thresholdSessionId,
+          ciphertext: clientEncryptedCiphertext,
+          keyVersion: args.transport.keyVersion
+        });
+        recordWarmSessionSealAndPersistDiagnosticDuration({
+          diagnostics,
+          bucket: "serverSealRouteMs",
+          startedAt: serverSealRouteStartedAt
+        });
+        if (!applied.ok)
+          return applied;
+        const policyUpdateStartedAt = performance.now();
+        const policy = resolvePolicyFromServerAndLocal({
+          localRemainingUses: entry.remainingUses,
+          localExpiresAtMs: entry.expiresAtMs,
+          serverRemainingUses: applied.remainingUses,
+          serverExpiresAtMs: applied.expiresAtMs
+        });
+        if (!policy.ok) {
+          deleteWarmSessionPrfHandle(thresholdSessionId);
+          return policy;
+        }
+        updateWarmSessionPrfHandlePolicy(thresholdSessionId, entry, policy);
+        recordWarmSessionSealAndPersistDiagnosticDuration({
+          diagnostics,
+          bucket: "policyUpdateMs",
+          startedAt: policyUpdateStartedAt
+        });
+        const keyVersion = normalizeOptionalNonEmptyString(applied.keyVersion) || normalizeOptionalNonEmptyString(args.transport.keyVersion);
+        const sealedSecretCacheKey = keyVersion ? await passkeyServerSealedSecretCacheKey({
+          prfFirstB64u: activeEntry.secret.prfFirstB64u,
+          relayerUrl: args.transport.relayerUrl,
+          keyVersion,
+          cacheScope: args.transport.serverSealedSecretCacheScope
+        }) : null;
+        const cachedSealedSecret = readPasskeyServerSealedSecretCache(sealedSecretCacheKey);
+        let sealedSecretB64u = cachedSealedSecret?.sealedSecretB64u || "";
+        if (!sealedSecretB64u) {
+          const clientUnsealStartedAt = performance.now();
+          sealedSecretB64u = await runtime.removeClientSealWithKeyHandle({
+            ciphertextB64u: applied.ciphertext,
+            keyHandle: clientKeyHandle.keyHandle
+          });
+          recordWarmSessionSealAndPersistDiagnosticDuration({
+            diagnostics,
+            bucket: "clientUnsealMs",
+            startedAt: clientUnsealStartedAt
+          });
+          writePasskeyServerSealedSecretCache({
+            cacheKey: sealedSecretCacheKey,
+            sealedSecretB64u,
+            expiresAtMs: policy.expiresAtMs
+          });
+        }
+        return {
+          ok: true,
+          sealedSecretB64u,
+          ...keyVersion ? { keyVersion } : {},
+          remainingUses: policy.remainingUses,
+          expiresAtMs: policy.expiresAtMs,
+          diagnostics
+        };
+      } finally {
+        await runtime.destroyClientKeyHandle({ keyHandle: clientKeyHandle.keyHandle }).catch(() => {
+          return;
+        });
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        code: "internal",
+        message: error instanceof Error ? error.message : String(error || "Failed to apply server seal")
+      };
+    }
+  })().finally(() => {
+    signingSessionSealApplyInFlight.delete(singleFlightKey);
+  });
+  signingSessionSealApplyInFlight.set(singleFlightKey, task);
+  return await task;
+}
+async function runSigningSessionRehydrate(args) {
+  const thresholdSessionId = normalizeOptionalTrimmedString(args.thresholdSessionId);
+  if (!thresholdSessionId) {
+    return { ok: false, code: "invalid_args", message: "Missing threshold sessionId" };
+  }
+  const sealedSecretB64u = normalizeOptionalTrimmedString(args.sealedSecretB64u);
+  if (!sealedSecretB64u) {
+    return { ok: false, code: "invalid_args", message: "Missing sealedSecretB64u" };
+  }
+  const localRemainingUses = Math.max(0, Math.floor(Number(args.remainingUses) || 0));
+  const localExpiresAtMs = Math.max(0, Math.floor(Number(args.expiresAtMs) || 0));
+  if (localRemainingUses <= 0) {
+    return {
+      ok: false,
+      code: "exhausted",
+      message: "Warm-session material exhausted for threshold session"
+    };
+  }
+  if (localExpiresAtMs <= nowMs()) {
+    return {
+      ok: false,
+      code: "expired",
+      message: "Warm-session material expired for threshold session"
+    };
+  }
+  const singleFlightKey = makeSigningSessionSealSingleFlightKey({
+    operation: "remove-server-seal",
+    thresholdSessionId,
+    relayerUrl: args.transport.relayerUrl,
+    keyVersion: args.keyVersion || args.transport.keyVersion,
+    payloadKey: sealedSecretB64u
+  });
+  const inFlight = signingSessionSealRemoveInFlight.get(singleFlightKey);
+  if (inFlight)
+    return await inFlight;
+  const task = (async () => {
+    try {
+      const runtime = await getShamir3PassRuntime();
+      const clientKeyHandle = await runtime.createClientKeyHandle({
+        groupId: SIGNING_SESSION_SEAL_GROUP_ID
+      });
+      try {
+        const clientEncryptedCiphertext = await runtime.addClientSealWithKeyHandle({
+          ciphertextB64u: sealedSecretB64u,
+          keyHandle: clientKeyHandle.keyHandle
+        });
+        const removed = await callSigningSessionSealRoute({
+          operation: "remove-server-seal",
+          transport: args.transport,
+          thresholdSessionId,
+          ciphertext: clientEncryptedCiphertext,
+          keyVersion: normalizeOptionalNonEmptyString(args.keyVersion) || args.transport.keyVersion
+        });
+        if (!removed.ok)
+          return removed;
+        const prfFirstB64u = await runtime.removeClientSealWithKeyHandle({
+          ciphertextB64u: removed.ciphertext,
+          keyHandle: clientKeyHandle.keyHandle
+        });
+        const policy = resolvePolicyFromServerAndLocal({
+          localRemainingUses,
+          localExpiresAtMs,
+          serverRemainingUses: removed.remainingUses,
+          serverExpiresAtMs: removed.expiresAtMs
+        });
+        if (!policy.ok)
+          return policy;
+        storeWarmSessionPrfHandle({
+          thresholdSessionId,
+          prfFirstB64u,
+          remainingUses: policy.remainingUses,
+          expiresAtMs: policy.expiresAtMs
+        });
+        return policy;
+      } finally {
+        await runtime.destroyClientKeyHandle({ keyHandle: clientKeyHandle.keyHandle }).catch(() => {
+          return;
+        });
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        code: "internal",
+        message: error instanceof Error ? error.message : String(error || "Failed to remove server seal")
+      };
+    }
+  })().finally(() => {
+    signingSessionSealRemoveInFlight.delete(singleFlightKey);
+  });
+  signingSessionSealRemoveInFlight.set(singleFlightKey, task);
+  return await task;
+}
+function postPasskeyMpcSessionWorkerResponse(id, payload) {
+  const response = payload.success ? {
+    ...typeof id === "string" && id.trim() ? { id: id.trim() } : {},
+    success: true,
+    data: payload.data
+  } : {
+    ...typeof id === "string" && id.trim() ? { id: id.trim() } : {},
+    success: false,
+    error: payload.error
+  };
+  try {
+    self.postMessage(response);
+  } catch {}
+}
+self.onmessage = (event) => {
+  const incoming = parsePasskeyMpcSessionWorkerMessage(event.data);
+  switch (incoming.kind) {
+    case "ping":
+      postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: { ok: true } });
+      return;
+    case "prewarm":
+      (async () => {
+        const outcome = await warmupShamir3PassRuntime();
+        postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: outcome });
+      })();
+      return;
+    case "material_put": {
+      try {
+        const payload = incoming.payload;
+        if (!payload) {
+          postPasskeyMpcSessionWorkerResponse(incoming.id, {
+            success: true,
+            data: {
+              ok: false,
+              code: "invalid_args",
+              message: "Invalid WARM_SESSION_MATERIAL_PUT payload"
+            }
+          });
+          return;
+        }
+        const { thresholdSessionId, prfFirstB64u, expiresAtMs, remainingUses } = payload;
+        if (expiresAtMs <= nowMs() || remainingUses <= 0) {
+          postPasskeyMpcSessionWorkerResponse(incoming.id, {
+            success: true,
+            data: {
+              ok: false,
+              code: "invalid_args",
+              message: "Invalid expiresAtMs or remainingUses"
+            }
+          });
+          return;
+        }
+        storeWarmSessionPrfHandle({ thresholdSessionId, prfFirstB64u, expiresAtMs, remainingUses });
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: true,
+          data: { ok: true, remainingUses, expiresAtMs }
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        postPasskeyMpcSessionWorkerResponse(incoming.id, { success: false, error: message });
+      }
+      return;
+    }
+    case "status_read":
+      if (!incoming.payload) {
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: false,
+          error: "Invalid WARM_SESSION_STATUS_READ payload"
+        });
+        return;
+      }
+      postPasskeyMpcSessionWorkerResponse(incoming.id, {
+        success: true,
+        data: readWarmSessionClaimEntry(incoming.payload.thresholdSessionId)
+      });
+      return;
+    case "status_batch_read":
+      if (!incoming.payload) {
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: false,
+          error: "Invalid WARM_SESSION_STATUS_BATCH_READ payload"
+        });
+        return;
+      }
+      postPasskeyMpcSessionWorkerResponse(incoming.id, {
+        success: true,
+        data: {
+          results: Array.from(new Set(incoming.payload.thresholdSessionIds)).map((thresholdSessionId) => ({
+            thresholdSessionId,
+            result: readWarmSessionClaimEntry(thresholdSessionId)
+          }))
+        }
+      });
+      return;
+    case "material_claim":
+      if (!incoming.payload) {
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: false,
+          error: "Invalid WARM_SESSION_MATERIAL_CLAIM payload"
+        });
+        return;
+      }
+      postPasskeyMpcSessionWorkerResponse(incoming.id, {
+        success: true,
+        data: claimWarmSessionMaterialEntry(incoming.payload.thresholdSessionId, incoming.payload.uses, incoming.payload.consume)
+      });
+      return;
+    case "material_consume":
+      if (!incoming.payload) {
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: false,
+          error: "Invalid WARM_SESSION_MATERIAL_CONSUME payload"
+        });
+        return;
+      }
+      postPasskeyMpcSessionWorkerResponse(incoming.id, {
+        success: true,
+        data: consumeWarmSessionMaterialEntry(incoming.payload.thresholdSessionId, incoming.payload.uses)
+      });
+      return;
+    case "volatile_clear": {
+      const command = parseClearVolatileWarmMaterialCommand(incoming.payload);
+      if (command?.scope.kind === "session") {
+        deleteWarmSessionPrfHandle(String(command.scope.thresholdSessionId));
+      }
+      postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: { ok: true } });
+      return;
+    }
+    case "volatile_clear_all":
+      clearWarmSessionPrfHandles();
+      postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: { ok: true } });
+      return;
+    case "seal_and_persist":
+      (async () => {
+        const payload = incoming.payload;
+        if (!payload) {
+          postPasskeyMpcSessionWorkerResponse(incoming.id, {
+            success: true,
+            data: {
+              ok: false,
+              code: "invalid_args",
+              message: "Invalid WARM_SESSION_SEAL_AND_PERSIST payload"
+            }
+          });
+          return;
+        }
+        const result = await runSigningSessionSealAndPersist(payload);
+        postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: result });
+      })();
+      return;
+    case "rehydrate":
+      (async () => {
+        const payload = incoming.payload;
+        if (!payload) {
+          postPasskeyMpcSessionWorkerResponse(incoming.id, {
+            success: true,
+            data: {
+              ok: false,
+              code: "invalid_args",
+              message: "Invalid WARM_SESSION_REHYDRATE payload"
+            }
+          });
+          return;
+        }
+        const result = await runSigningSessionRehydrate(payload);
+        postPasskeyMpcSessionWorkerResponse(incoming.id, { success: true, data: result });
+      })();
+      return;
+    case "unknown":
+      if (incoming.id) {
+        postPasskeyMpcSessionWorkerResponse(incoming.id, {
+          success: false,
+          error: `Unsupported Passkey MPC session worker message type: ${String(incoming.type)}`
+        });
+      }
+      return;
+  }
+};
+self.onerror = (error) => {
+  console.error("[passkey-mpc-session-worker] error:", error);
+};
+self.onunhandledrejection = (event) => {
+  console.error("[passkey-mpc-session-worker] Unhandled promise rejection:", event.reason);
+  event.preventDefault();
+};