@seams/wallet 0.6.2 → 0.7.1

package/dist/esm/react/core/signingEngine/session/persistence/sealedSessionStore.js

@@ -1,104 +1,17 @@
 import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { normalizeInteger, normalizeOptionalNonEmptyString } from "../../../../shared-ts/src/utils/normalize.js";
+import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, SIGNING_SESSION_SEAL_STORAGE_SCOPE, SIGNING_SESSION_SECRET_KIND, parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromRequest, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
+import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
 import { signingSessionSealsRepository } from "../../../indexedDB/seamsWalletDB/signingSessionSeals.js";
 import { exactSealedSessionFilterForIdentity } from "./durableSealedSessionCommands.js";
-import { parseEcdsaRoleLocalPersistedMaterialRef } from "../keyMaterialBrands.js";
-import { ecdsaSealedRecordStoreKey } from "./ecdsaSealedRecordKey.js";
+import { buildEcdsaInactiveMaterialPublicRestore, classifyNonCurrentRecord, classifyRawSealedSessionRecord, hasRetiredAuthorizationIdentityField, inactiveEcdsaMaterialStorageRow, logSealedSessionClassification, makeInactiveEcdsaMaterialStoreKey, normalizeSigningSessionSealedStoreRecord, normalizeThresholdSessionIdsFromStoredRecord, requireInactiveEcdsaSealedMaterial, sealedRecordStorageRow, storagePayloadFromSealedStoreRow } from "./sealedSessionRecords.js";
 //#region src/core/signingEngine/session/persistence/sealedSessionStore.ts
-const ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND = "ecdsa_inactive_sealed_material_v1";
-var SealedSessionRecordUserActionRequiredError = class extends Error {
-	constructor(classification) {
-		super(`[SigningSessionSealedStore] sealed session record requires user action: ${classification.reason}`);
-		this.name = "SealedSessionRecordUserActionRequiredError";
-		this.classification = classification;
-	}
-};
 const DEFAULT_RESTORE_LEASE_TTL_MS = 15e3;
-const SEALED_RECORD_PAYLOAD_FIELD = "sealed_record";
 function createRandomId(prefix) {
 	return secureRandomId(prefix, 32, "sealed signing session restore IDs");
 }
-function normalizeThresholdSessionIds(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : {};
-	const ed25519 = normalizeOptionalNonEmptyString(obj.ed25519);
-	const ecdsa = normalizeOptionalNonEmptyString(obj.ecdsa);
-	return {
-		...ed25519 ? { ed25519 } : {},
-		...ecdsa ? { ecdsa } : {}
-	};
-}
-function normalizeThresholdSessionIdsFromStoredRecord(value) {
-	return normalizeThresholdSessionIds((value && typeof value === "object" && !Array.isArray(value) ? value : {}).thresholdSessionIds);
-}
-function hasRetiredAuthorizationIdentityField(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!obj) return false;
-	const camelCaseKey = [
-		"signing",
-		"Grant",
-		"Id"
-	].join("");
-	const snakeCaseKey = [
-		"signing",
-		"grant",
-		"id"
-	].join("_");
-	return Object.prototype.hasOwnProperty.call(obj, camelCaseKey) || Object.prototype.hasOwnProperty.call(obj, snakeCaseKey);
-}
-function normalizeCurve(value) {
-	const curve = String(value || "").trim();
-	return curve === "ed25519" || curve === "ecdsa" ? curve : void 0;
-}
-function storagePayloadFromSealedStoreRow(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	return obj && SEALED_RECORD_PAYLOAD_FIELD in obj ? obj[SEALED_RECORD_PAYLOAD_FIELD] : value;
-}
-function optionalStringForIndex(value) {
-	return normalizeOptionalNonEmptyString(value);
-}
-function durableLaneStorageRow(record) {
-	const ecdsaChainTarget = record.ecdsaRestore?.chainTarget;
-	const ecdsaThresholdSessionId = optionalStringForIndex(record.thresholdSessionIds.ecdsa);
-	const ed25519ThresholdSessionId = optionalStringForIndex(record.thresholdSessionIds.ed25519);
-	return {
-		store_key: record.storeKey,
-		wallet_id: record.walletId,
-		auth_method: record.authMethod,
-		curve: record.curve,
-		signing_root_id: optionalStringForIndex("signingRootId" in record ? record.signingRootId : void 0),
-		signing_root_version: optionalStringForIndex("signingRootVersion" in record ? record.signingRootVersion : void 0),
-		ed25519_threshold_session_id: ed25519ThresholdSessionId,
-		ecdsa_threshold_session_id: ecdsaThresholdSessionId,
-		threshold_session_id: ecdsaThresholdSessionId || ed25519ThresholdSessionId,
-		key_handle: optionalStringForIndex(record.ecdsaRestore?.keyHandle),
-		chain_target_key: ecdsaChainTarget ? thresholdEcdsaChainTargetKey(ecdsaChainTarget) : void 0,
-		expires_at_ms: record.expiresAtMs,
-		updated_at: record.updatedAtMs,
-		[SEALED_RECORD_PAYLOAD_FIELD]: record
-	};
-}
-function inactiveEcdsaMaterialStorageRow(record) {
-	return {
-		store_key: record.storeKey,
-		wallet_id: record.walletId,
-		auth_method: record.authMethod,
-		curve: record.curve,
-		key_handle: record.ecdsaRestore.keyHandle,
-		chain_target_key: thresholdEcdsaChainTargetKey(record.ecdsaRestore.chainTarget),
-		updated_at: record.updatedAtMs,
-		[SEALED_RECORD_PAYLOAD_FIELD]: record
-	};
-}
-function sealedRecordStorageRow(record) {
-	return durableLaneStorageRow(record);
-}
 function restoreLeaseStorageRow(lease) {
 	return {
 		lease_key: lease.leaseKey,
@@ -109,203 +22,6 @@ function restoreLeaseStorageRow(lease) {
 		lease
 	};
 }
-function normalizeEthereumAddress(value) {
-	const normalized = String(value || "").trim().toLowerCase();
-	return /^0x[0-9a-f]{40}$/.test(normalized) ? normalized : void 0;
-}
-function resolveSealedRecordCurve(args) {
-	if (args.curve) return args.curve;
-	if (args.thresholdSessionIds.ecdsa) return "ecdsa";
-	if (args.thresholdSessionIds.ed25519) return "ed25519";
-	return null;
-}
-function parseSealedEcdsaRouterAbDerivationNormalSigningState(value) {
-	try {
-		return parseRouterAbEcdsaDerivationNormalSigningStateV1(value);
-	} catch {
-		return null;
-	}
-}
-function normalizeSealedEcdsaRestoreSource(value) {
-	switch (value) {
-		case "login":
-		case "registration":
-		case "manual-bootstrap":
-		case "email_otp": return value;
-		default: return null;
-	}
-}
-function signingRootBindingFromStoredRuntimePolicyScope(value) {
-	try {
-		const scope = signingRootScopeFromRuntimePolicyScope(normalizeRuntimePolicyScope(value));
-		const signingRootId = normalizeOptionalNonEmptyString(scope.signingRootId);
-		const signingRootVersion = normalizeOptionalNonEmptyString(scope.signingRootVersion);
-		return signingRootId && signingRootVersion ? {
-			signingRootId,
-			signingRootVersion
-		} : null;
-	} catch {
-		return null;
-	}
-}
-function normalizeEcdsaRestoreMetadata(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!obj) return void 0;
-	let chainTarget = null;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(obj.chainTarget && typeof obj.chainTarget === "object" && !Array.isArray(obj.chainTarget) ? obj.chainTarget : {});
-	} catch {
-		chainTarget = null;
-	}
-	const source = normalizeSealedEcdsaRestoreSource(obj.source);
-	const authorityRef = parseWalletAuthAuthorityRef(obj.authority);
-	const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-	const runtimePolicyScope = obj.runtimePolicyScope && typeof obj.runtimePolicyScope === "object" ? obj.runtimePolicyScope : void 0;
-	const runtimeSigningRootBinding = signingRootBindingFromStoredRuntimePolicyScope(runtimePolicyScope);
-	const explicitSigningRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const explicitSigningRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	if (explicitSigningRootId && runtimeSigningRootBinding?.signingRootId && explicitSigningRootId !== runtimeSigningRootBinding.signingRootId) return;
-	if (explicitSigningRootVersion && runtimeSigningRootBinding?.signingRootVersion && explicitSigningRootVersion !== runtimeSigningRootBinding.signingRootVersion) return;
-	const signingRootId = explicitSigningRootId || runtimeSigningRootBinding?.signingRootId || "";
-	const signingRootVersion = explicitSigningRootVersion || runtimeSigningRootBinding?.signingRootVersion || "";
-	const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-	let roleLocalMaterialRef = null;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(obj.roleLocalMaterialRef);
-	} catch {
-		roleLocalMaterialRef = null;
-	}
-	const emailOtpAuthority = parseEmailOtpWalletAuthAuthority(obj.emailOtpAuthority);
-	const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-	const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-	const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-	const keyHandle = normalizeOptionalNonEmptyString(obj.keyHandle);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(obj.ecdsaThresholdKeyId);
-	const ethereumAddress = normalizeEthereumAddress(obj.ethereumAddress);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(obj.thresholdEcdsaPublicKeyB64u);
-	const routerAbEcdsaDerivationNormalSigning = parseSealedEcdsaRouterAbDerivationNormalSigningState(obj.routerAbEcdsaDerivationNormalSigning);
-	let publicCapability = null;
-	try {
-		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(obj.publicCapability);
-	} catch {
-		publicCapability = null;
-	}
-	const participantIds = Array.isArray(obj.participantIds) ? obj.participantIds.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0) : [];
-	if (!chainTarget || !source || !signingRootId || !signingRootVersion || !keyHandle || !ethereumAddress || !relayerKeyId || !routerAbEcdsaDerivationNormalSigning || !publicCapability || !participantIds.length) return;
-	const authBranch = credentialIdB64u && rpId && roleLocalMaterialRef && authorityRef && source !== "email_otp" ? {
-		source,
-		authority: authorityRef,
-		roleLocalMaterialRef,
-		rpId,
-		credentialIdB64u
-	} : providerSubjectId && provider && emailHashHex && roleLocalMaterialRef && authorityRef && emailOtpAuthority && source === "email_otp" ? {
-		source,
-		provider,
-		providerSubjectId,
-		emailHashHex,
-		authority: authorityRef,
-		emailOtpAuthority,
-		roleLocalMaterialRef
-	} : null;
-	if (!authBranch) return void 0;
-	const clientVerifyingShareB64u = normalizeOptionalNonEmptyString(obj.clientVerifyingShareB64u);
-	return {
-		chainTarget,
-		signingRootId,
-		signingRootVersion,
-		...authBranch,
-		keyHandle,
-		...ecdsaThresholdKeyId ? { ecdsaThresholdKeyId } : {},
-		ethereumAddress,
-		relayerKeyId,
-		...clientVerifyingShareB64u ? { clientVerifyingShareB64u } : {},
-		...thresholdEcdsaPublicKeyB64u ? { thresholdEcdsaPublicKeyB64u } : {},
-		participantIds,
-		routerAbEcdsaDerivationNormalSigning,
-		publicCapability,
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function normalizeCurrentEd25519RestoreMetadata(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : null;
-	if (!obj) return void 0;
-	const nearAccountId = normalizeOptionalNonEmptyString(obj.nearAccountId);
-	const nearEd25519SigningKeyId = normalizeOptionalNonEmptyString(obj.nearEd25519SigningKeyId);
-	const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-	const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-	const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-	const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-	const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-	const authSubjectId = normalizeOptionalNonEmptyString(obj.authSubjectId);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const participantIds = Array.isArray(obj.participantIds) ? obj.participantIds.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0) : [];
-	const signerSlot = normalizeInteger(obj.signerSlot);
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(obj.routerAbNormalSigning);
-	const materialActivation = parseMpcMaterialActivationRef(obj.materialActivation);
-	const authBranch = credentialIdB64u && !providerSubjectId && materialActivation.ok ? {
-		credentialIdB64u,
-		materialActivation: materialActivation.value
-	} : provider && providerSubjectId && emailHashHex && !credentialIdB64u && materialActivation.ok ? {
-		provider,
-		providerSubjectId,
-		emailHashHex,
-		materialActivation: materialActivation.value
-	} : null;
-	if (!nearAccountId || !nearEd25519SigningKeyId || !rpId || !relayerKeyId || !participantIds.length || signerSlot == null || signerSlot <= 0 || !routerAbNormalSigning || !authBranch || authSubjectId) return;
-	return {
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		rpId,
-		...authBranch,
-		relayerKeyId,
-		participantIds,
-		...obj.runtimePolicyScope && typeof obj.runtimePolicyScope === "object" ? { runtimePolicyScope: obj.runtimePolicyScope } : {},
-		signerSlot,
-		routerAbNormalSigning
-	};
-}
-function ed25519SealedRecordStoreKey(args) {
-	const materialActivation = args.restore.materialActivation;
-	return [
-		"ed25519-material-v2",
-		args.walletId,
-		args.authMethod,
-		"ed25519",
-		materialActivation.activationId,
-		materialActivation.capability,
-		materialActivation.materialOwner,
-		materialActivation.keyBinding,
-		materialActivation.lifecycleBinding,
-		materialActivation.signingWorker
-	].map(sealedStoreKeyPart).join(":");
-}
-function makeInactiveEcdsaMaterialStoreKey(args) {
-	const material = args.restore.roleLocalMaterialRef;
-	return [
-		"inactive-material",
-		args.walletId,
-		args.authMethod,
-		"ecdsa",
-		thresholdEcdsaChainTargetKey(args.restore.chainTarget),
-		material.materialActivation.activationId
-	].map(sealedStoreKeyPart).join(":");
-}
-function sealedStoreKeyPart(value) {
-	return encodeURIComponent(String(value || "").trim());
-}
-function normalizeAuthMethod(value) {
-	const authMethod = String(value || "").trim();
-	return authMethod === "passkey" || authMethod === "email_otp" ? authMethod : void 0;
-}
-function hasStaleSealedSessionWalletIdentityFields(value) {
-	const obj = asRawSealedSessionRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.subjectId) || normalizeOptionalNonEmptyString(obj?.userId));
-}
-function hasTopLevelSigningRootFields(value) {
-	const obj = asRawSealedSessionRecord(value);
-	return Boolean(normalizeOptionalNonEmptyString(obj?.signingRootId) || normalizeOptionalNonEmptyString(obj?.signingRootVersion));
-}
 function sealedRecordAccountKeys(record) {
 	const keys = /* @__PURE__ */ new Set();
 	const walletId = normalizeOptionalNonEmptyString(record.walletId);
@@ -370,417 +86,29 @@ async function compactExactEd25519Records(matches, options = { writeCanonical: f
 	});
 	return selected.record;
 }
-function normalizeParticipantIds(value) {
-	if (!Array.isArray(value)) return [];
-	return value.map((participantId) => Math.floor(Number(participantId))).filter((participantId) => Number.isFinite(participantId) && participantId > 0);
-}
-function asRawSealedSessionRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function buildSealedSessionSafeSummary(obj) {
-	return {
-		authMethod: normalizeOptionalNonEmptyString(obj?.authMethod) || null,
-		curve: normalizeOptionalNonEmptyString(obj?.curve) || null,
-		storeKey: normalizeOptionalNonEmptyString(obj?.storeKey) || null,
-		walletId: normalizeOptionalNonEmptyString(obj?.walletId) || null,
-		thresholdSessionIds: normalizeThresholdSessionIdsFromStoredRecord(obj),
-		hasEcdsaRestore: Boolean(asRawSealedSessionRecord(obj?.ecdsaRestore)),
-		hasEd25519Restore: Boolean(asRawSealedSessionRecord(obj?.ed25519Restore)),
-		issuedAtMs: normalizeInteger(obj?.issuedAtMs),
-		expiresAtMs: normalizeInteger(obj?.expiresAtMs),
-		remainingUses: normalizeInteger(obj?.remainingUses),
-		updatedAtMs: normalizeInteger(obj?.updatedAtMs)
-	};
-}
-function classifyNonCurrentRecord(kind, obj, reason) {
-	return {
-		kind,
-		storeKey: normalizeOptionalNonEmptyString(obj?.storeKey) || null,
-		walletId: normalizeOptionalNonEmptyString(obj?.walletId) || null,
-		reason,
-		safeSummary: buildSealedSessionSafeSummary(obj)
-	};
-}
-function classifyRawSealedSessionRecord(raw) {
-	raw = storagePayloadFromSealedStoreRow(raw);
-	const obj = asRawSealedSessionRecord(raw);
-	if (!obj) return classifyNonCurrentRecord("malformed", null, "invalid_payload");
-	if (obj.kind === "lane_sealed_holder_record_v1") return classifyNonCurrentRecord("unrelated_record", obj, "owned_by_lane_holder_store");
-	if (hasRetiredAuthorizationIdentityField(obj)) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-	if (obj.recordKind === "ecdsa_reauth_anchor_v1") return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
-	if (obj.recordKind === ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) {
-		const record = normalizeEcdsaInactiveSealedMaterialRecord(obj);
-		return record ? {
-			kind: "ecdsa_inactive_material",
-			record
-		} : classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	}
-	if (Number(obj.v) === 1) return classifyNonCurrentRecord("delete_required", obj, "invalid_header");
-	if (Number(obj.v) !== 2) return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.alg || "").trim() !== "shamir3pass-v2") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.storageScope || "").trim() !== "iframe_origin_indexeddb") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	if (String(obj.secretKind || "").trim() !== "signing_session_secret32") return classifyNonCurrentRecord("malformed", obj, "invalid_header");
-	const authMethod = String(obj.authMethod || "").trim();
-	const thresholdSessionIds = normalizeThresholdSessionIdsFromStoredRecord(obj);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(obj.sealedSecretB64u);
-	const curve = normalizeCurve(obj.curve);
-	const subjectId = normalizeOptionalNonEmptyString(obj.subjectId);
-	const userId = normalizeOptionalNonEmptyString(obj.userId);
-	const walletId = normalizeOptionalNonEmptyString(obj.walletId);
-	const signingRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const explicitSigningRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	const signingRootVersion = explicitSigningRootVersion || (signingRootId ? "default" : null);
-	const relayerUrl = normalizeOptionalNonEmptyString(obj.relayerUrl);
-	const keyVersion = normalizeOptionalNonEmptyString(obj.keyVersion);
-	const groupId = normalizeOptionalNonEmptyString(obj.groupId);
-	const issuedAtMs = normalizeInteger(obj.issuedAtMs);
-	const expiresAtMs = normalizeInteger(obj.expiresAtMs);
-	const remainingUses = normalizeInteger(obj.remainingUses);
-	const updatedAtMs = normalizeInteger(obj.updatedAtMs);
-	if (!sealedSecretB64u || !keyVersion || groupId !== "rfc2409-group2") return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (authMethod !== "passkey" && authMethod !== "email_otp") return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (!thresholdSessionIds.ed25519 && !thresholdSessionIds.ecdsa) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (!walletId) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	const recordCurve = resolveSealedRecordCurve({
-		curve,
-		thresholdSessionIds
-	});
-	if (!recordCurve) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (issuedAtMs == null || issuedAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (expiresAtMs == null || expiresAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (remainingUses == null || remainingUses < 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (updatedAtMs == null || updatedAtMs <= 0) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	const ecdsaRestoreObj = asRawSealedSessionRecord(obj.ecdsaRestore);
-	const ed25519RestoreObj = asRawSealedSessionRecord(obj.ed25519Restore);
-	const ecdsaRestore = normalizeEcdsaRestoreMetadata(obj.ecdsaRestore);
-	const ed25519Restore = normalizeCurrentEd25519RestoreMetadata(obj.ed25519Restore);
-	if (recordCurve === "ecdsa") {
-		if (!thresholdSessionIds.ecdsa) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-		if (subjectId || userId || signingRootId || explicitSigningRootVersion) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-		if (!ecdsaRestoreObj || !relayerUrl) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-		if (!normalizeParticipantIds(ecdsaRestoreObj.participantIds).length) return classifyNonCurrentRecord("delete_required", obj, "missing_participant_ids");
-		if (!ecdsaRestore) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-		const storeKey = ecdsaSealedRecordStoreKey({
-			walletId,
-			authMethod,
-			chainTarget: ecdsaRestore.chainTarget,
-			materialActivation: ecdsaRestore.roleLocalMaterialRef.materialActivation
-		});
-		const providedStoreKey = normalizeOptionalNonEmptyString(obj.storeKey);
-		if (providedStoreKey && providedStoreKey !== storeKey) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-		return {
-			kind: "current",
-			record: {
-				v: 2,
-				alg: SIGNING_SESSION_SEAL_ALG,
-				storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-				authMethod,
-				secretKind: SIGNING_SESSION_SECRET_KIND,
-				storeKey,
-				thresholdSessionIds: {
-					...thresholdSessionIds.ed25519 ? { ed25519: thresholdSessionIds.ed25519 } : {},
-					ecdsa: thresholdSessionIds.ecdsa
-				},
-				sealedSecretB64u,
-				curve: "ecdsa",
-				walletId,
-				relayerUrl,
-				keyVersion,
-				groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-				ecdsaRestore,
-				...ed25519Restore ? { ed25519Restore } : {},
-				issuedAtMs,
-				expiresAtMs,
-				remainingUses,
-				updatedAtMs
-			}
-		};
-	}
-	if (!thresholdSessionIds.ed25519) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	if (subjectId || userId) return classifyNonCurrentRecord("delete_required", obj, "invalid_identity");
-	if (!ed25519RestoreObj || !relayerUrl) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-	if (!normalizeParticipantIds(ed25519RestoreObj.participantIds).length) return classifyNonCurrentRecord("delete_required", obj, "missing_participant_ids");
-	if (!ed25519Restore) return classifyNonCurrentRecord("rebuild_required", obj, "missing_restore_metadata");
-	const storeKey = ed25519SealedRecordStoreKey({
-		walletId,
-		authMethod,
-		restore: ed25519Restore
-	});
-	const providedStoreKey = normalizeOptionalNonEmptyString(obj.storeKey);
-	if (providedStoreKey && providedStoreKey !== storeKey) return classifyNonCurrentRecord("malformed", obj, "invalid_identity");
-	return {
-		kind: "current",
-		record: {
-			v: 2,
-			alg: SIGNING_SESSION_SEAL_ALG,
-			storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-			authMethod,
-			secretKind: SIGNING_SESSION_SECRET_KIND,
-			storeKey,
-			thresholdSessionIds: {
-				ed25519: thresholdSessionIds.ed25519,
-				...thresholdSessionIds.ecdsa ? { ecdsa: thresholdSessionIds.ecdsa } : {}
-			},
-			sealedSecretB64u,
-			curve: "ed25519",
-			walletId,
-			...signingRootId ? { signingRootId } : {},
-			...signingRootVersion ? { signingRootVersion } : {},
-			relayerUrl,
-			keyVersion,
-			groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-			...ecdsaRestore ? { ecdsaRestore } : {},
-			ed25519Restore,
-			issuedAtMs,
-			expiresAtMs,
-			remainingUses,
-			updatedAtMs
-		}
-	};
-}
-function normalizeSigningSessionSealedStoreRecord(value) {
-	const classification = classifyRawSealedSessionRecord(storagePayloadFromSealedStoreRow(value));
-	return classification.kind === "current" ? classification.record : null;
-}
 async function classifyPersistedSealedRecord(entry) {
 	const payload = storagePayloadFromSealedStoreRow(entry.value);
 	const classification = classifyRawSealedSessionRecord(payload);
 	if (classification.kind !== "current") return classification;
-	const raw = asRawSealedSessionRecord(payload);
-	if (hasRetiredAuthorizationIdentityField(asRawSealedSessionRecord(entry.value)) || hasRetiredAuthorizationIdentityField(raw)) return classifyNonCurrentRecord("delete_required", raw, "invalid_identity");
-	const persistedStoreKey = normalizeOptionalNonEmptyString(raw?.storeKey);
-	if (!persistedStoreKey || persistedStoreKey === classification.record.storeKey) return classification;
+	const raw = asRecord(payload);
+	if (hasRetiredAuthorizationIdentityField(asRecord(entry.value)) || hasRetiredAuthorizationIdentityField(raw)) return classifyNonCurrentRecord("delete_required", raw, "invalid_identity");
 	return classification;
 }
-function normalizeEcdsaInactiveMaterialPublicRestore(value) {
-	const obj = asRawSealedSessionRecord(value);
-	if (!obj) return null;
-	if (obj.clientVerifyingShareB64u != null) return null;
-	let chainTarget;
-	let runtimePolicyScope;
-	let routerAbEcdsaDerivationNormalSigning;
-	let publicCapability;
-	try {
-		chainTarget = thresholdEcdsaChainTargetFromRequest(obj.chainTarget && typeof obj.chainTarget === "object" ? obj.chainTarget : {});
-		runtimePolicyScope = normalizeRuntimePolicyScope(obj.runtimePolicyScope);
-		const parsedRouterAbState = parseRouterAbEcdsaDerivationNormalSigningStateV1(obj.routerAbEcdsaDerivationNormalSigning);
-		if (!parsedRouterAbState) return null;
-		routerAbEcdsaDerivationNormalSigning = parsedRouterAbState;
-		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(obj.publicCapability);
-	} catch {
-		return null;
-	}
-	const signingRootId = normalizeOptionalNonEmptyString(obj.signingRootId);
-	const signingRootVersion = normalizeOptionalNonEmptyString(obj.signingRootVersion);
-	let roleLocalMaterialRef = null;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(obj.roleLocalMaterialRef);
-	} catch {
-		roleLocalMaterialRef = null;
-	}
-	const authorityRef = parseWalletAuthAuthorityRef(obj.authority);
-	const emailOtpAuthority = parseEmailOtpWalletAuthAuthority(obj.emailOtpAuthority);
-	const keyHandle = normalizeOptionalNonEmptyString(obj.keyHandle);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(obj.ecdsaThresholdKeyId);
-	const ethereumAddress = normalizeOptionalNonEmptyString(obj.ethereumAddress);
-	const relayerKeyId = normalizeOptionalNonEmptyString(obj.relayerKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(obj.thresholdEcdsaPublicKeyB64u);
-	const participantIds = normalizeParticipantIds(obj.participantIds);
-	if (!signingRootId || !signingRootVersion || !keyHandle || !ecdsaThresholdKeyId || !ethereumAddress || !relayerKeyId || !thresholdEcdsaPublicKeyB64u || !participantIds.length) return null;
-	switch (obj.source) {
-		case "email_otp": {
-			const provider = obj.provider === "google" || obj.provider === "email" ? obj.provider : null;
-			const providerSubjectId = normalizeOptionalNonEmptyString(obj.providerSubjectId);
-			const emailHashHex = normalizeOptionalNonEmptyString(obj.emailHashHex);
-			if (!provider || !providerSubjectId || !emailHashHex || !roleLocalMaterialRef || !authorityRef || !emailOtpAuthority || obj.rpId != null || obj.credentialIdB64u != null) return null;
-			return {
-				chainTarget,
-				signingRootId,
-				signingRootVersion,
-				keyHandle,
-				ecdsaThresholdKeyId,
-				ethereumAddress,
-				relayerKeyId,
-				thresholdEcdsaPublicKeyB64u,
-				participantIds,
-				runtimePolicyScope,
-				routerAbEcdsaDerivationNormalSigning,
-				publicCapability,
-				source: "email_otp",
-				provider,
-				providerSubjectId,
-				emailHashHex,
-				authority: authorityRef,
-				emailOtpAuthority,
-				roleLocalMaterialRef
-			};
-		}
-		case "login":
-		case "registration":
-		case "manual-bootstrap": {
-			const rpId = normalizeOptionalNonEmptyString(obj.rpId);
-			const credentialIdB64u = normalizeOptionalNonEmptyString(obj.credentialIdB64u);
-			if (!rpId || !credentialIdB64u || !roleLocalMaterialRef || !authorityRef || obj.providerSubjectId != null || obj.emailHashHex != null) return null;
-			return {
-				chainTarget,
-				signingRootId,
-				signingRootVersion,
-				keyHandle,
-				ecdsaThresholdKeyId,
-				ethereumAddress,
-				relayerKeyId,
-				thresholdEcdsaPublicKeyB64u,
-				participantIds,
-				runtimePolicyScope,
-				routerAbEcdsaDerivationNormalSigning,
-				publicCapability,
-				source: obj.source,
-				authority: authorityRef,
-				roleLocalMaterialRef,
-				rpId,
-				credentialIdB64u
-			};
-		}
-		default: return null;
-	}
-}
-function normalizeEcdsaInactiveSealedMaterialRecord(value) {
-	const obj = asRawSealedSessionRecord(storagePayloadFromSealedStoreRow(value));
-	if (!obj || obj.recordKind !== ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND) return null;
-	if (hasRetiredAuthorizationIdentityField(obj) || obj.thresholdSessionIds != null || obj.ed25519Restore != null) return null;
-	if (obj.curve !== "ecdsa") return null;
-	const authMethod = normalizeAuthMethod(obj.authMethod);
-	const walletId = normalizeOptionalNonEmptyString(obj.walletId);
-	const relayerUrl = normalizeOptionalNonEmptyString(obj.relayerUrl);
-	const ecdsaRestore = normalizeEcdsaInactiveMaterialPublicRestore(obj.ecdsaRestore);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(obj.sealedSecretB64u);
-	const keyVersion = normalizeOptionalNonEmptyString(obj.keyVersion);
-	const groupId = normalizeOptionalNonEmptyString(obj.groupId);
-	const updatedAtMs = normalizeInteger(obj.updatedAtMs);
-	const authorizationRetirementReason = obj.authorizationRetirementReason;
-	if (!authMethod || !walletId || !relayerUrl || !ecdsaRestore || obj.alg !== "shamir3pass-v2" || obj.storageScope !== "iframe_origin_indexeddb" || obj.secretKind !== "signing_session_secret32" || !sealedSecretB64u || !keyVersion || groupId !== "rfc2409-group2" || obj.issuedAtMs != null || obj.expiresAtMs != null || obj.remainingUses != null || updatedAtMs == null || updatedAtMs <= 0) return null;
-	if (authorizationRetirementReason !== "expired" && authorizationRetirementReason !== "exhausted") return null;
-	const storeKey = makeInactiveEcdsaMaterialStoreKey({
-		walletId,
-		authMethod,
-		restore: ecdsaRestore
-	});
-	if (normalizeOptionalNonEmptyString(obj.storeKey) !== storeKey) return null;
-	const common = {
-		recordKind: ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND,
-		storeKey,
-		curve: "ecdsa",
-		walletId,
-		relayerUrl,
-		alg: SIGNING_SESSION_SEAL_ALG,
-		storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-		secretKind: SIGNING_SESSION_SECRET_KIND,
-		sealedSecretB64u,
-		keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		updatedAtMs,
-		authorizationRetirementReason
-	};
-	if (authMethod === "email_otp" && ecdsaRestore.source === "email_otp") return {
-		...common,
-		authMethod,
-		ecdsaRestore
-	};
-	if (authMethod === "passkey" && ecdsaRestore.source !== "email_otp") return {
-		...common,
-		authMethod,
-		ecdsaRestore
-	};
-	return null;
-}
 function rawThresholdSessionIdsFromSealedStoreRow(value) {
-	const payload = storagePayloadFromSealedStoreRow(value);
-	return normalizeThresholdSessionIdsFromStoredRecord(payload && typeof payload === "object" && !Array.isArray(payload) ? payload : null);
-}
-function logSealedSessionClassification(args) {
-	if (args.classification.kind === "ecdsa_inactive_material") return;
-	if (args.classification.kind === "rebuild_required") return;
-	if (args.classification.kind === "unrelated_record") return;
-	const outcome = args.classification.kind === "malformed" ? "malformed" : "rejected";
-	const payload = {
-		operation: args.operation,
-		outcome,
-		classificationKind: args.classification.kind,
-		...args.classification
-	};
-	console.warn("[SigningSessionSealedStore] rejected sealed record", payload);
+	return normalizeThresholdSessionIdsFromStoredRecord(storagePayloadFromSealedStoreRow(value));
 }
-function buildCurrentSealedSessionRecord(args) {
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	const curve = normalizeCurve(args.curve);
-	const authMethod = args.authMethod === "passkey" || args.authMethod === "email_otp" ? args.authMethod : void 0;
-	if (!curve || !authMethod) return null;
-	const thresholdSessionIds = thresholdSessionIdsForWrite({
-		thresholdSessionId,
-		curve,
-		thresholdSessionIds: args.thresholdSessionIds
-	});
-	const walletId = normalizeOptionalNonEmptyString(args.walletId);
-	const sealedSecretB64u = normalizeOptionalNonEmptyString(args.sealedSecretB64u);
-	const expiresAtMs = normalizeInteger(args.expiresAtMs);
-	const remainingUses = normalizeInteger(args.remainingUses);
-	const issuedAtMs = normalizeInteger(args.issuedAtMs);
-	const updatedAtMs = normalizeInteger(args.updatedAtMs);
-	const keyVersion = normalizeOptionalNonEmptyString(args.keyVersion);
-	if (!thresholdSessionId || !sealedSecretB64u || !keyVersion || args.groupId !== "rfc2409-group2") return null;
-	if (!thresholdSessionIds.ed25519 && !thresholdSessionIds.ecdsa) return null;
-	if (issuedAtMs == null || issuedAtMs <= 0) return null;
-	if (expiresAtMs == null || expiresAtMs <= 0) return null;
-	if (remainingUses == null || remainingUses < 0) return null;
-	if (updatedAtMs == null || updatedAtMs <= 0) return null;
-	const ecdsaRestore = normalizeEcdsaRestoreMetadata(args.ecdsaRestore);
-	const ed25519Restore = normalizeCurrentEd25519RestoreMetadata(args.ed25519Restore);
-	if (hasStaleSealedSessionWalletIdentityFields(args)) return null;
-	if (curve === "ecdsa") {
-		if (!ecdsaRestore?.chainTarget || !walletId) return null;
-		if (hasTopLevelSigningRootFields(args)) return null;
-	}
-	let signingRootIdForWrite;
-	let signingRootVersionForWrite;
-	if (args.curve === "ed25519") {
-		signingRootIdForWrite = normalizeOptionalNonEmptyString(args.signingRootId);
-		signingRootVersionForWrite = normalizeOptionalNonEmptyString(args.signingRootVersion);
-	}
-	const classification = classifyRawSealedSessionRecord({
-		v: 2,
-		alg: SIGNING_SESSION_SEAL_ALG,
-		storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-		authMethod,
-		secretKind: SIGNING_SESSION_SECRET_KIND,
-		thresholdSessionIds,
-		sealedSecretB64u,
-		curve,
-		...walletId ? { walletId } : {},
-		...signingRootIdForWrite ? { signingRootId: signingRootIdForWrite } : {},
-		...signingRootVersionForWrite ? { signingRootVersion: signingRootVersionForWrite } : {},
-		...normalizeOptionalNonEmptyString(args.relayerUrl) ? { relayerUrl: normalizeOptionalNonEmptyString(args.relayerUrl) } : {},
-		keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		...ecdsaRestore ? { ecdsaRestore } : {},
-		...ed25519Restore ? { ed25519Restore } : {},
-		issuedAtMs,
-		expiresAtMs,
-		remainingUses,
-		updatedAtMs
+/** Logs a record that is not current, and queues it for deletion when it cannot be kept. */
+function setAsideRejectedSealedRecord(operation, classification, primaryKey, deletePrimaryKeys) {
+	logSealedSessionClassification({
+		operation,
+		classification
 	});
-	if (classification.kind !== "current") {
-		logSealedSessionClassification({
-			operation: "build current sealed session record",
-			classification
-		});
-		return null;
-	}
-	return classification.record;
+	if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(primaryKey);
 }
 function normalizeSigningSessionRestoreLease(value) {
-	const obj = value && typeof value === "object" && !Array.isArray(value) ? value : null;
+	const obj = asRecord(value);
 	if (!obj) return null;
-	if (obj.lease && typeof obj.lease === "object" && !Array.isArray(obj.lease)) return normalizeSigningSessionRestoreLease(obj.lease);
+	if (asRecord(obj.lease)) return normalizeSigningSessionRestoreLease(obj.lease);
 	if (Number(obj.v) !== 1) return null;
 	if (hasRetiredAuthorizationIdentityField(obj)) return null;
 	const leaseKey = normalizeOptionalNonEmptyString(obj.leaseKey);
@@ -810,14 +138,6 @@ function makeSigningSessionRestoreLease(args) {
 		expiresAtMs: args.nowMs + args.ttlMs
 	};
 }
-function thresholdSessionIdsForWrite(args) {
-	const explicit = normalizeThresholdSessionIds(args.thresholdSessionIds);
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	if (!thresholdSessionId) return {};
-	if (args.curve === "ed25519" && explicit.ed25519 === thresholdSessionId) return explicit;
-	if (args.curve === "ecdsa" && explicit.ecdsa === thresholdSessionId) return explicit;
-	return {};
-}
 function recordMatchesFilter(record, thresholdSessionId, filter) {
 	if (record.authMethod !== filter.authMethod) return false;
 	if (record.thresholdSessionIds[filter.curve] !== thresholdSessionId) return false;
@@ -852,15 +172,7 @@ async function readRecordByThresholdSessionId(thresholdSessionId, filter, operat
 			}
 			continue;
 		}
-		logSealedSessionClassification({
-			operation,
-			classification
-		});
-		if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(entry.primaryKey);
-		if (classification.kind === "user_action_required") {
-			await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-			throw new SealedSessionRecordUserActionRequiredError(classification);
-		}
+		setAsideRejectedSealedRecord(operation, classification, entry.primaryKey, deletePrimaryKeys);
 	}
 	await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
 	if (exactEd25519Matches.length > 0) return await compactExactEd25519Records(exactEd25519Matches);
@@ -911,6 +223,9 @@ async function readExactSealedSession(thresholdSessionIdRaw, filter) {
 	if (!thresholdSessionId) return null;
 	return await readRecordByThresholdSessionId(thresholdSessionId, purpose, "read");
 }
+function recordMatchesEd25519Locator(record, locator) {
+	return record.curve === "ed25519" && record.authMethod === locator.authMethod && mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, locator.materialActivation);
+}
 async function readExactEd25519SealedSession(locator) {
 	const entries = await signingSessionSealsRepository.collectAllRawSealedRecordEntries();
 	const deletePrimaryKeys = [];
@@ -919,18 +234,10 @@ async function readExactEd25519SealedSession(locator) {
 		const classification = await classifyPersistedSealedRecord(entry);
 		if (classification.kind === "current") {
 			const record = classification.record;
-			if (record.curve === "ed25519" && record.authMethod === locator.authMethod && mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, locator.materialActivation)) matches.push(persistedEd25519Record(entry, record));
+			if (recordMatchesEd25519Locator(record, locator)) matches.push(persistedEd25519Record(entry, record));
 			continue;
 		}
-		logSealedSessionClassification({
-			operation: "read exact Ed25519 material",
-			classification
-		});
-		if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(entry.primaryKey);
-		if (classification.kind === "user_action_required") {
-			await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-			throw new SealedSessionRecordUserActionRequiredError(classification);
-		}
+		setAsideRejectedSealedRecord("read exact Ed25519 material", classification, entry.primaryKey, deletePrimaryKeys);
 	}
 	await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
 	return await compactExactEd25519Records(matches);
@@ -949,15 +256,7 @@ async function listExactSealedSessionsForWallet(args) {
 		for (const value of values) {
 			const classification = await classifyPersistedSealedRecord(value);
 			if (classification.kind !== "current") {
-				logSealedSessionClassification({
-					operation: "list exact account records",
-					classification
-				});
-				if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(value.primaryKey);
-				if (classification.kind === "user_action_required") {
-					await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-					throw new SealedSessionRecordUserActionRequiredError(classification);
-				}
+				setAsideRejectedSealedRecord("list exact account records", classification, value.primaryKey, deletePrimaryKeys);
 				continue;
 			}
 			const record = classification.record;
@@ -1009,15 +308,7 @@ async function listEcdsaSealedSessionsForWallet(args) {
 				continue;
 			}
 			if (classification.kind !== "current") {
-				logSealedSessionClassification({
-					operation: "list wallet ecdsa records",
-					classification
-				});
-				if (classification.kind === "delete_required" || classification.kind === "malformed") deletePrimaryKeys.push(value.primaryKey);
-				if (classification.kind === "user_action_required") {
-					await signingSessionSealsRepository.deleteSealedRecords(deletePrimaryKeys);
-					throw new SealedSessionRecordUserActionRequiredError(classification);
-				}
+				setAsideRejectedSealedRecord("list wallet ecdsa records", classification, value.primaryKey, deletePrimaryKeys);
 				continue;
 			}
 			const record = classification.record;
@@ -1065,101 +356,15 @@ async function writeExactSealedSession(record) {
 		staleStoreKeys: [...staleRecords.map((record) => record.storeKey), ...replacedInactiveMaterialStoreKey ? [replacedInactiveMaterialStoreKey] : []]
 	});
 }
-function buildEcdsaInactiveMaterialPublicRestore(restore, relayerUrlRaw) {
-	const relayerUrl = normalizeOptionalNonEmptyString(relayerUrlRaw);
-	const ecdsaThresholdKeyId = normalizeOptionalNonEmptyString(restore.ecdsaThresholdKeyId);
-	const thresholdEcdsaPublicKeyB64u = normalizeOptionalNonEmptyString(restore.thresholdEcdsaPublicKeyB64u);
-	if (!relayerUrl || !ecdsaThresholdKeyId || !thresholdEcdsaPublicKeyB64u) return null;
-	let runtimePolicyScope;
-	try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(restore.runtimePolicyScope);
-	} catch {
-		return null;
-	}
-	switch (restore.source) {
-		case "email_otp": return {
-			chainTarget: restore.chainTarget,
-			signingRootId: restore.signingRootId,
-			signingRootVersion: restore.signingRootVersion,
-			keyHandle: restore.keyHandle,
-			ecdsaThresholdKeyId,
-			ethereumAddress: restore.ethereumAddress,
-			relayerKeyId: restore.relayerKeyId,
-			thresholdEcdsaPublicKeyB64u,
-			participantIds: [...restore.participantIds],
-			runtimePolicyScope,
-			routerAbEcdsaDerivationNormalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-			publicCapability: restore.publicCapability,
-			source: "email_otp",
-			provider: restore.provider,
-			providerSubjectId: restore.providerSubjectId,
-			emailHashHex: restore.emailHashHex,
-			authority: restore.authority,
-			emailOtpAuthority: restore.emailOtpAuthority,
-			roleLocalMaterialRef: parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef)
-		};
-		case "login":
-		case "registration":
-		case "manual-bootstrap": return {
-			chainTarget: restore.chainTarget,
-			signingRootId: restore.signingRootId,
-			signingRootVersion: restore.signingRootVersion,
-			keyHandle: restore.keyHandle,
-			ecdsaThresholdKeyId,
-			ethereumAddress: restore.ethereumAddress,
-			relayerKeyId: restore.relayerKeyId,
-			thresholdEcdsaPublicKeyB64u,
-			participantIds: [...restore.participantIds],
-			runtimePolicyScope,
-			routerAbEcdsaDerivationNormalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-			publicCapability: restore.publicCapability,
-			source: restore.source,
-			authority: restore.authority,
-			roleLocalMaterialRef: parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef),
-			rpId: restore.rpId,
-			credentialIdB64u: restore.credentialIdB64u
-		};
-	}
-}
-function buildInactiveEcdsaSealedMaterial(args) {
-	const record = args.record;
-	const publicRestore = buildEcdsaInactiveMaterialPublicRestore(record.ecdsaRestore, record.relayerUrl);
-	if (!publicRestore) return null;
-	const base = {
-		recordKind: ECDSA_INACTIVE_SEALED_MATERIAL_RECORD_KIND,
-		storeKey: makeInactiveEcdsaMaterialStoreKey({
-			walletId: record.walletId,
-			authMethod: record.authMethod,
-			restore: publicRestore
-		}),
-		curve: "ecdsa",
-		walletId: record.walletId,
-		relayerUrl: record.relayerUrl,
-		alg: SIGNING_SESSION_SEAL_ALG,
-		storageScope: SIGNING_SESSION_SEAL_STORAGE_SCOPE,
-		secretKind: SIGNING_SESSION_SECRET_KIND,
-		sealedSecretB64u: record.sealedSecretB64u,
-		keyVersion: record.keyVersion,
-		groupId: SIGNING_SESSION_SEAL_GROUP_ID,
-		updatedAtMs: args.updatedAtMs,
-		authorizationRetirementReason: args.retirement
-	};
-	if (record.authMethod === "email_otp" && publicRestore.source === "email_otp") return {
-		...base,
-		authMethod: "email_otp",
-		ecdsaRestore: publicRestore
-	};
-	if (record.authMethod === "passkey" && publicRestore.source !== "email_otp") return {
-		...base,
-		authMethod: "passkey",
-		ecdsaRestore: publicRestore
-	};
-	return null;
-}
-function requireInactiveEcdsaSealedMaterial(args) {
-	const inactiveMaterial = buildInactiveEcdsaSealedMaterial(args);
-	if (!inactiveMaterial) throw new Error("[SigningSessionSealedStore] inactive ECDSA material requires exact public restore facts");
-	return inactiveMaterial;
+function retireEcdsaSealedSession(record, retirement, updatedAtMs) {
+	return writeInactiveEcdsaSealedMaterial({
+		current: record,
+		inactive: requireInactiveEcdsaSealedMaterial({
+			record,
+			retirement,
+			updatedAtMs
+		})
+	});
 }
 async function writeInactiveEcdsaSealedMaterial(args) {
 	await signingSessionSealsRepository.replaceSealedRecordAndDeleteRestoreLease({
@@ -1194,27 +399,12 @@ async function writeUpdatedSealedSessionPolicy(existing, args) {
 		remainingUses,
 		updatedAtMs
 	};
-	if (updatedRecord.curve === "ecdsa" && expiresAtMs <= Date.now()) {
-		await writeInactiveEcdsaSealedMaterial({
-			current: updatedRecord,
-			inactive: requireInactiveEcdsaSealedMaterial({
-				record: updatedRecord,
-				retirement: "expired",
-				updatedAtMs
-			})
-		});
-		return;
-	}
-	if (updatedRecord.curve === "ecdsa" && remainingUses === 0) {
-		await writeInactiveEcdsaSealedMaterial({
-			current: updatedRecord,
-			inactive: requireInactiveEcdsaSealedMaterial({
-				record: updatedRecord,
-				retirement: "exhausted",
-				updatedAtMs
-			})
-		});
-		return;
+	if (updatedRecord.curve === "ecdsa") {
+		const retirement = expiresAtMs <= Date.now() ? "expired" : remainingUses === 0 ? "exhausted" : null;
+		if (retirement) {
+			await retireEcdsaSealedSession(updatedRecord, retirement, updatedAtMs);
+			return;
+		}
 	}
 	await writeExactSealedSession(updatedRecord);
 }
@@ -1240,7 +430,7 @@ async function deleteExactEd25519SealedSession(locator, options) {
 			continue;
 		}
 		const record = classification.record;
-		if (record.curve !== "ed25519" || record.authMethod !== locator.authMethod || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, locator.materialActivation)) continue;
+		if (!recordMatchesEd25519Locator(record, locator)) continue;
 		deletePrimaryKeys.push(entry.primaryKey);
 		if (options.deleteResolvedIdentity) restoreLeaseKeys.push(record.storeKey);
 	}
@@ -1263,14 +453,7 @@ async function deleteDurableSealedSessionRecord(command) {
 	const filter = exactSealedSessionFilterForIdentity(command.durableRecord);
 	const existingRecord = await readExactSealedSessionOrNull(command.durableRecord.thresholdSessionId, filter);
 	if (command.preserveResolvedIdentity && command.durableRecord.curve === "ecdsa" && existingRecord?.curve === "ecdsa" && (command.deleteReason === "expired" || command.deleteReason === "exhausted")) {
-		await writeInactiveEcdsaSealedMaterial({
-			current: existingRecord,
-			inactive: requireInactiveEcdsaSealedMaterial({
-				record: existingRecord,
-				retirement: command.deleteReason,
-				updatedAtMs: Date.now()
-			})
-		});
+		await retireEcdsaSealedSession(existingRecord, command.deleteReason, Date.now());
 		return;
 	}
 	await deleteExactSealedSession(command.durableRecord.thresholdSessionId, filter, options);
@@ -1330,6 +513,6 @@ async function releaseSigningSessionRestoreLease(lease) {
 	});
 }
 //#endregion
-export { acquireSigningSessionRestoreLease, buildCurrentSealedSessionRecord, deleteDurableSealedSessionRecord, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactEd25519SealedSession, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactEd25519SealedSessionPolicy, updateExactSealedSessionPolicy, writeExactSealedSession };
+export { acquireSigningSessionRestoreLease, deleteDurableSealedSessionRecord, listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet, readExactEd25519SealedSession, readExactSealedSession, releaseSigningSessionRestoreLease, updateExactEd25519SealedSessionPolicy, updateExactSealedSessionPolicy, writeExactSealedSession };
 
 //# sourceMappingURL=sealedSessionStore.js.map