@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/signingEngine/session/lifecycle/walletSessionFailure.js

@@ -1,69 +0,0 @@
-import { WALLET_SESSION_FAILURE_CODES, isWalletSessionFailureCode } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-//#region src/core/signingEngine/session/lifecycle/walletSessionFailure.ts
-var WalletSessionFailureError = class extends Error {
-	constructor(args) {
-		super(args.message);
-		this.name = "WalletSessionFailureError";
-		this.failure = args.failure;
-		this.code = args.failure.code;
-	}
-};
-function walletSessionFailureFromCode(code) {
-	switch (code) {
-		case WALLET_SESSION_FAILURE_CODES.expired: return {
-			kind: "expired",
-			code
-		};
-		case WALLET_SESSION_FAILURE_CODES.missing: return {
-			kind: "missing",
-			code
-		};
-		case WALLET_SESSION_FAILURE_CODES.signatureInvalid: return {
-			kind: "invalid",
-			code,
-			reason: "signature_invalid"
-		};
-		case WALLET_SESSION_FAILURE_CODES.claimsInvalid: return {
-			kind: "invalid",
-			code,
-			reason: "claims_invalid"
-		};
-		case WALLET_SESSION_FAILURE_CODES.invalid: return {
-			kind: "invalid",
-			code,
-			reason: "invalid"
-		};
-		case WALLET_SESSION_FAILURE_CODES.scopeMismatch: return {
-			kind: "invalid",
-			code,
-			reason: "scope_mismatch"
-		};
-		case WALLET_SESSION_FAILURE_CODES.unavailable: return {
-			kind: "unavailable",
-			code
-		};
-		case WALLET_SESSION_FAILURE_CODES.budgetExhausted: return {
-			kind: "exhausted",
-			code
-		};
-	}
-}
-function walletSessionFailureErrorFromPayload(args) {
-	if (!isWalletSessionFailureCode(args.code)) return null;
-	return new WalletSessionFailureError({
-		failure: walletSessionFailureFromCode(args.code),
-		message: args.message
-	});
-}
-function walletSessionFailureFromError(error) {
-	if (error instanceof WalletSessionFailureError) return error.failure;
-	if (!error || typeof error !== "object") return null;
-	const record = error;
-	if (isWalletSessionFailureCode(record.coreCode)) return walletSessionFailureFromCode(record.coreCode);
-	if (isWalletSessionFailureCode(record.code)) return walletSessionFailureFromCode(record.code);
-	return null;
-}
-//#endregion
-export { WalletSessionFailureError, walletSessionFailureErrorFromPayload, walletSessionFailureFromCode, walletSessionFailureFromError };
-
-//# sourceMappingURL=walletSessionFailure.js.map

package/dist/esm/react/core/signingEngine/session/lifecycle/walletSessionStatus.js

@@ -1,123 +0,0 @@
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-//#region src/core/signingEngine/session/lifecycle/walletSessionStatus.ts
-function normalizeSessionStatusRequired(value, label) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`[WalletSessionStatus] ${label} is required`);
-	return normalized;
-}
-function parseWalletSessionStatusIdentity(value) {
-	const walletSessionId = parseWalletSessionId(value.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(value.quotaId);
-	if (!walletSessionId.ok || !quotaId.ok) return null;
-	return {
-		walletSessionId: walletSessionId.value,
-		quotaId: quotaId.value
-	};
-}
-function buildWalletSessionStatusCheck(args) {
-	const authorization = parseWalletSessionStatusIdentity(args.authorization);
-	if (!authorization) throw new Error("[WalletSessionStatus] canonical Wallet Session identity is invalid");
-	return {
-		kind: "wallet_session_status_check",
-		owner: args.owner,
-		authorization
-	};
-}
-function ed25519WalletSessionStatusOwner(walletId) {
-	return {
-		curve: "ed25519",
-		walletId: toWalletId(walletId)
-	};
-}
-function walletSessionStatusOwnerForLane(lane) {
-	return ed25519WalletSessionStatusOwner(lane.identity.signer.account.wallet.walletId);
-}
-function walletSessionStatusOwnerId(owner) {
-	return owner.walletId;
-}
-function walletSessionStatusOwnerKey(owner) {
-	return `${owner.curve}:${walletSessionStatusOwnerId(owner)}`;
-}
-function walletSessionStatusIdentityKey(identity) {
-	return `${identity.walletSessionId}:${identity.quotaId}`;
-}
-function signingSessionStatusFromWalletSessionStatus(status) {
-	const sessionId = String(status.walletSessionId);
-	switch (status.status) {
-		case "active": return {
-			sessionId,
-			status: "active",
-			remainingUses: status.remainingUses,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "exhausted": return {
-			sessionId,
-			status: "exhausted",
-			remainingUses: 0,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "expired": return {
-			sessionId,
-			status: "expired",
-			expiresAtMs: status.expiresAtMs
-		};
-		case "missing":
-		case "superseded": return {
-			sessionId,
-			status: "not_found",
-			statusCode: status.status
-		};
-		case "authority_unavailable":
-		case "method_unavailable":
-		case "capability_unavailable": return {
-			sessionId,
-			status: "unavailable",
-			statusCode: status.status,
-			expiresAtMs: status.expiresAtMs
-		};
-		case "invalid": return {
-			sessionId,
-			status: "status_unknown",
-			statusCode: "invalid_wallet_session_status"
-		};
-		default: throw new Error("[WalletSessionStatus] unsupported canonical status");
-	}
-}
-function unknownSigningSessionStatus(args) {
-	return {
-		sessionId: String(args.walletSessionId),
-		status: "status_unknown",
-		statusCode: args.reason
-	};
-}
-async function getWalletSessionStatus(deps, args) {
-	return await deps.getAvailableStatus(args).catch(() => null);
-}
-function mergeWalletSigningSessionStatus(status, sessionStatus) {
-	if (!sessionStatus) return status;
-	if (sessionStatus.status === "status_unknown") return status;
-	if (sessionStatus.status !== "active") return {
-		...status,
-		...sessionStatus,
-		sessionId: status.sessionId
-	};
-	const sessionRemainingUses = Math.max(0, Math.floor(Number(sessionStatus.remainingUses) || 0));
-	const statusExpiresAtMs = Math.floor(Number(status.expiresAtMs) || 0);
-	const sessionExpiresAtMs = Math.floor(Number(sessionStatus.expiresAtMs) || 0);
-	return {
-		...status,
-		status: "active",
-		remainingUses: sessionRemainingUses,
-		expiresAtMs: statusExpiresAtMs > 0 && sessionExpiresAtMs > 0 ? Math.min(statusExpiresAtMs, sessionExpiresAtMs) : statusExpiresAtMs || sessionExpiresAtMs,
-		...sessionStatus.authMethod ? { authMethod: sessionStatus.authMethod } : {},
-		...sessionStatus.retention ? { retention: sessionStatus.retention } : {}
-	};
-}
-function buildWalletSessionStatusCheckForSession(args) {
-	return buildWalletSessionStatusCheck(args);
-}
-//#endregion
-export { buildWalletSessionStatusCheck, buildWalletSessionStatusCheckForSession, ed25519WalletSessionStatusOwner, getWalletSessionStatus, mergeWalletSigningSessionStatus, normalizeSessionStatusRequired, signingSessionStatusFromWalletSessionStatus, unknownSigningSessionStatus, walletSessionStatusIdentityKey, walletSessionStatusOwnerForLane, walletSessionStatusOwnerKey };
-
-//# sourceMappingURL=walletSessionStatus.js.map

package/dist/esm/react/core/signingEngine/session/material/activeEcdsaCapabilityRuntime.js

@@ -1,171 +0,0 @@
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { resolveExactEcdsaSealedRuntime } from "./ecdsaSealedRuntime.js";
-//#region src/core/signingEngine/session/material/activeEcdsaCapabilityRuntime.ts
-function manifestCoversTarget(args) {
-	return args.manifest.signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetsEqual(membership, args.chainTarget));
-}
-async function listActiveManifestsForTarget(args) {
-	return (await args.ports.listActiveEcdsaCapabilityManifestsForWallet(args.walletId)).filter((manifest) => manifestCoversTarget({
-		manifest,
-		chainTarget: args.chainTarget
-	}));
-}
-async function listSealedEcdsaRecordsForWallet(args) {
-	const records = [];
-	const authMethods = args.authMethod ? [args.authMethod] : ["passkey", "email_otp"];
-	for (const authMethod of authMethods) {
-		const found = await args.ports.listExactSealedSessionsForWallet({
-			walletId: String(args.walletId),
-			filter: {
-				authMethod,
-				curve: "ecdsa",
-				chainTarget: args.chainTarget
-			}
-		}).catch(() => []);
-		for (const record of found) if (record.curve === "ecdsa") records.push(record);
-	}
-	return records;
-}
-async function resolveExactEcdsaCapabilityRuntime(args) {
-	if (!manifestCoversTarget({
-		manifest: args.manifest,
-		chainTarget: args.chainTarget
-	})) return {
-		kind: "blocked",
-		reason: "chain_mismatch"
-	};
-	const durable = args.manifest.durableMaterial;
-	const facts = durable.roleLocalPublicFacts;
-	const participantIds = exactTwoPartyParticipantIds(facts.participantIds);
-	const relayerUrl = String(args.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!participantIds || !relayerUrl) return {
-		kind: "blocked",
-		reason: "corrupt"
-	};
-	return {
-		kind: "resolved",
-		manifest: args.manifest,
-		runtime: {
-			kind: "exact_ecdsa_capability_runtime_v1",
-			walletId: args.manifest.signer.walletId,
-			chainTarget: args.chainTarget,
-			materialActivation: durable.materialActivation,
-			normalSigning: durable.routerAbEcdsaDerivationNormalSigning,
-			relayerUrl,
-			relayerKeyId: String(durable.roleLocalBinding.relayerKeyId),
-			clientVerifyingPublicKey33B64u: durable.roleLocalBinding.clientVerifyingPublicKey33B64u,
-			participantIds,
-			ecdsaThresholdKeyId: String(facts.ecdsaThresholdKeyId),
-			thresholdEcdsaPublicKeyB64u: facts.groupPublicKey33B64u,
-			keyHandle: String(facts.keyHandle),
-			runtimePolicyScope: durable.runtimePolicyScope,
-			roleLocalMaterialRef: {
-				kind: "ecdsa_role_local_persisted_material_ref_v1",
-				durableMaterialRef: durable.durableMaterialRef,
-				bindingDigest: durable.bindingDigest,
-				materialActivation: durable.materialActivation
-			}
-		}
-	};
-}
-function exactTwoPartyParticipantIds(value) {
-	if (value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) return null;
-	return [first, second];
-}
-async function narrowToSelectedMethod(ports, walletId, manifests) {
-	const selected = await ports.resolveSelectedWalletAuthority(String(walletId));
-	if (selected.kind !== "resolved") return manifests;
-	const selectedMethodId = String(selected.authMethod.walletAuthMethodId);
-	const matching = manifests.filter((manifest) => String(manifest.signer.authority.walletAuthMethodId) === selectedMethodId);
-	return matching.length > 0 ? matching : manifests;
-}
-async function resolveActiveEcdsaCapabilityRuntime(ports, args) {
-	const all = await listActiveManifestsForTarget({
-		ports,
-		...args
-	});
-	if (all.length === 0) return {
-		kind: "blocked",
-		reason: "missing_capability"
-	};
-	const manifests = all.length > 1 ? await narrowToSelectedMethod(ports, args.walletId, all) : all;
-	if (manifests.length !== 1) return {
-		kind: "blocked",
-		reason: "exact_record_conflict"
-	};
-	const manifest = manifests[0];
-	const sealedRecords = await listSealedEcdsaRecordsForWallet({
-		ports,
-		...args
-	});
-	const resolution = resolveExactEcdsaSealedRuntime({
-		manifest,
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		sealedRecords
-	});
-	return resolution.kind === "resolved" ? {
-		kind: "resolved",
-		manifest,
-		runtime: resolution.runtime
-	} : {
-		kind: "blocked",
-		reason: resolution.reason
-	};
-}
-function createActiveEcdsaCapabilityRuntimeResolver(ports) {
-	return resolveActiveEcdsaCapabilityRuntime.bind(null, ports);
-}
-/** Resolve by chain kind, taking the exact chain target from the manifest's own
-* target memberships. The warm-session envelope is keyed by kind (evm/tempo)
-* while correlation needs a full target, and the manifest is the authority on
-* which targets its capability covers. */
-async function resolveActiveEcdsaCapabilityRuntimeForChain(ports, args) {
-	const manifests = await ports.listActiveEcdsaCapabilityManifestsForWallet(args.walletId);
-	const matches = [];
-	for (const manifest of manifests) for (const membership of manifest.signer.scope.targetMemberships) {
-		if (membership.kind !== args.chain) continue;
-		matches.push({
-			manifest,
-			chainTarget: membership
-		});
-	}
-	if (matches.length === 0) return {
-		kind: "blocked",
-		reason: "missing_capability"
-	};
-	if (matches.length > 1) return {
-		kind: "blocked",
-		reason: "exact_record_conflict"
-	};
-	const match = matches[0];
-	const sealedRecords = await listSealedEcdsaRecordsForWallet({
-		ports,
-		walletId: args.walletId,
-		chainTarget: match.chainTarget
-	});
-	const resolution = resolveExactEcdsaSealedRuntime({
-		manifest: match.manifest,
-		walletId: args.walletId,
-		chainTarget: match.chainTarget,
-		sealedRecords
-	});
-	return resolution.kind === "resolved" ? {
-		kind: "resolved",
-		manifest: match.manifest,
-		runtime: resolution.runtime
-	} : {
-		kind: "blocked",
-		reason: resolution.reason
-	};
-}
-function createActiveEcdsaCapabilityRuntimeForChainResolver(ports) {
-	return resolveActiveEcdsaCapabilityRuntimeForChain.bind(null, ports);
-}
-//#endregion
-export { createActiveEcdsaCapabilityRuntimeForChainResolver, createActiveEcdsaCapabilityRuntimeResolver, resolveExactEcdsaCapabilityRuntime };
-
-//# sourceMappingURL=activeEcdsaCapabilityRuntime.js.map

package/dist/esm/react/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.js

@@ -1,323 +0,0 @@
-import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { computeEcdsaDerivationRoleLocalRelayerKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, buildResolvedEvmFamilyEcdsaKey, buildVerifiedEcdsaPublicFacts, deriveEvmFamilyEcdsaKeyHandle, toRpId, toThresholdOwnerAddress } from "../identity/evmFamilyEcdsaIdentity.js";
-import { isActiveEcdsaWalletAuthorityV1, isCombinedWalletSignerActivationSetV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { resolveLinkedEcdsaHolderRuntimeV1 } from "./linkedEcdsaHolderRuntime.js";
-import { bytesToHex } from "../../chains/evm/bytes.js";
-//#region src/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.ts
-function blocked(reason, message) {
-	return message ? {
-		kind: "blocked",
-		reason,
-		message
-	} : {
-		kind: "blocked",
-		reason
-	};
-}
-function activeAuthorityEcdsaActivation(authority) {
-	if (isActiveEcdsaWalletAuthorityV1(authority)) return authority.signerActivations;
-	if (isCombinedWalletSignerActivationSetV1(authority.signerActivations)) return authority.signerActivations;
-	return null;
-}
-function exactAuthorityResolution(value) {
-	if (value.kind !== "resolved") switch (value.kind) {
-		case "missing_selection": return blocked("missing_selected_authority");
-		case "missing_auth_method":
-		case "missing_authority":
-		case "integrity_error": return blocked("invalid_selected_authority");
-		default: return value;
-	}
-	if (value.selection.walletId !== value.authMethod.walletId || value.selection.walletAuthMethodId !== value.authMethod.walletAuthMethodId || value.authMethod.walletAuthorityId !== value.authority.authorityId || value.authority.walletId !== value.selection.walletId) return blocked("authority_identity_mismatch");
-	if (value.selection.lockState !== "unlocked") return blocked("wallet_locked");
-	if (value.authMethod.status !== "active") return blocked("auth_method_inactive");
-	if (value.authority.state !== "active") return blocked("authority_inactive");
-	return {
-		selection: value.selection,
-		authMethod: value.authMethod,
-		authority: value.authority,
-		signerMaterials: value.signerMaterials
-	};
-}
-function exactEcdsaSignerMaterial(args) {
-	const matches = args.materials.filter((material) => material.kind === "wallet_authority_linked_signer_material_v1" && material.keyFamily === "ecdsa_secp256k1" && material.authorityId === args.authority.authorityId && material.walletAuthMethodId === args.authMethod.walletAuthMethodId && material.activationId === args.materialActivation.activationId && mpcMaterialActivationRefsEqual(material.materialActivation, args.materialActivation));
-	const [match] = matches;
-	return matches.length === 1 && match ? match : null;
-}
-function linkedMaterialTargetFactorMatches(args) {
-	const target = args.material.targetFactor;
-	if (target.walletAuthMethodId !== args.authMethod.walletAuthMethodId) return false;
-	if (args.authMethod.kind === "passkey") return target.kind === "passkey" && target.rpId === args.authMethod.rpId && target.credentialIdB64u === args.authMethod.credentialIdB64u;
-	return target.kind === "email_otp" && target.emailHashHex === args.authMethod.emailHashHex && target.registrationAuthorityId === args.authMethod.registrationAuthorityId;
-}
-function exactSessionCapability(args) {
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === args.capability && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
-}
-function exactNormalSigningMaterialActivation(normalSigning) {
-	try {
-		return routerAbMpcMaterialActivationRefFromWire(normalSigning.scope.material_activation);
-	} catch {
-		return null;
-	}
-}
-function normalSigningAddress(normalSigning) {
-	try {
-		return bytesToHex(base64UrlDecode(normalSigning.scope.public_identity.ethereum_address20_b64u));
-	} catch {
-		return null;
-	}
-}
-function linkedEcdsaSourceSignerIdentitiesEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.clientPublicKey33B64u === right.clientPublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u;
-}
-function linkedEcdsaTargetRecipientPreparationsEqual(left, right) {
-	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && left.targetDeviceId === right.targetDeviceId && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
-}
-function linkedEcdsaSourceContributionBindingsEqual(left, right) {
-	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && linkedEcdsaSourceSignerIdentitiesEqual(left.source, right.source) && linkedEcdsaTargetRecipientPreparationsEqual(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
-}
-function linkedEcdsaNormalSigningStatesEqual(left, right) {
-	return left.kind === right.kind && sameRouterAbEcdsaDerivationNormalSigningScopeV1(left.scope, right.scope);
-}
-function linkedEcdsaSourceDerivationsEqual(left, right) {
-	return left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && linkedEcdsaNormalSigningStatesEqual(left.sourceNormalSigning, right.sourceNormalSigning);
-}
-function linkedEcdsaActivationReceiptsEqual(left, right) {
-	return left.state === right.state && linkedEcdsaSourceContributionBindingsEqual(left.binding, right.binding) && linkedEcdsaSourceDerivationsEqual(left.sourceDerivation, right.sourceDerivation) && left.targetRelayerPublicKey33B64u === right.targetRelayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u && linkedEcdsaNormalSigningStatesEqual(left.normalSigning, right.normalSigning);
-}
-function exactHolderRuntime(args) {
-	const runtime = resolveLinkedEcdsaHolderRuntimeV1({
-		walletId: args.walletId,
-		materialActivation: args.materialActivation
-	});
-	if (!runtime) return null;
-	if (runtime.walletId !== args.walletId || runtime.authorityId !== args.authority.authorityId || runtime.walletAuthMethodId !== args.authMethod.walletAuthMethodId || runtime.factorAuthority.walletId !== args.walletId || runtime.factorAuthority.bindingId !== args.authMethod.walletAuthMethodId || runtime.ecdsaThresholdKeyId !== args.ecdsaThresholdKeyId || !mpcMaterialActivationRefsEqual(runtime.materialActivation, args.materialActivation) || !linkedMaterialTargetFactorMatches({
-		material: args.material,
-		authMethod: args.authMethod
-	}) || !linkedEcdsaActivationReceiptsEqual(runtime.activationReceipt, args.material.publicFacts.activationReceipt)) return null;
-	return runtime;
-}
-async function buildActiveRuntime(args) {
-	const normalSigning = args.holderRuntime.activationReceipt.normalSigning;
-	const normalScope = normalSigning.scope;
-	const normalActivation = exactNormalSigningMaterialActivation(normalSigning);
-	const normalAddress = normalSigningAddress(normalSigning);
-	if (!normalActivation || !normalAddress || !mpcMaterialActivationRefsEqual(normalActivation, args.materialActivation) || args.signer.walletId !== args.selected.authority.walletId || normalScope.wallet_id !== String(args.selected.authority.walletId) || normalScope.ecdsa_threshold_key_id !== String(args.holderRuntime.ecdsaThresholdKeyId) || normalScope.public_identity.threshold_public_key33_b64u !== String(args.signer.thresholdPublicKey33B64u) || normalAddress.toLowerCase() !== String(args.signer.evmAddress).trim().toLowerCase() || String(args.holderRuntime.activationReceipt.thresholdPublicKey33B64u) !== String(normalScope.public_identity.threshold_public_key33_b64u) || String(args.holderRuntime.activationReceipt.thresholdEthereumAddress20B64u) !== String(normalScope.public_identity.ethereum_address20_b64u)) return blocked("normal_signing_identity_mismatch");
-	let key;
-	let publicFacts;
-	let relayerKeyId;
-	let keyHandle;
-	try {
-		keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
-			ecdsaThresholdKeyId: normalScope.ecdsa_threshold_key_id,
-			signingRootId: normalScope.signing_root_id,
-			signingRootVersion: normalScope.signing_root_version
-		});
-		const thresholdOwnerAddress = toThresholdOwnerAddress(args.signer.evmAddress);
-		key = buildBaseEvmFamilyEcdsaKeyIdentity({
-			walletId: args.selected.authority.walletId,
-			ecdsaThresholdKeyId: normalScope.ecdsa_threshold_key_id,
-			signingRootId: normalScope.signing_root_id,
-			signingRootVersion: normalScope.signing_root_version,
-			participantIds: [1, 2],
-			thresholdOwnerAddress
-		});
-		publicFacts = buildVerifiedEcdsaPublicFacts({
-			keyHandle,
-			publicKeyB64u: normalScope.public_identity.threshold_public_key33_b64u,
-			participantIds: [1, 2],
-			thresholdOwnerAddress
-		});
-		relayerKeyId = await computeEcdsaDerivationRoleLocalRelayerKeyId({
-			walletId: String(key.walletId),
-			signingRootId: String(key.signingRootId),
-			signingRootVersion: String(key.signingRootVersion)
-		});
-	} catch (error) {
-		return blocked("invalid_public_facts", error instanceof Error ? error.message : String(error));
-	}
-	if (key.ecdsaThresholdKeyId !== args.holderRuntime.ecdsaThresholdKeyId) return blocked("normal_signing_identity_mismatch");
-	let factorAuthorityRef;
-	try {
-		factorAuthorityRef = await walletAuthAuthorityRef({ authority: args.factorAuthority });
-	} catch (error) {
-		return blocked("authority_identity_mismatch", error instanceof Error ? error.message : String(error));
-	}
-	const runtime = {
-		kind: "active_wallet_authority_ecdsa_runtime_v1",
-		walletId: args.selected.authority.walletId,
-		authorityId: args.selected.authority.authorityId,
-		walletAuthMethodId: args.selected.authMethod.walletAuthMethodId,
-		authorityDigestB64u: args.selected.authority.authorityDigestB64u,
-		factorAuthorityRef,
-		authorityRevocationEpoch: args.selected.authority.revocationEpoch,
-		walletSessionId: args.operationCredential.walletSessionId,
-		operationCredential: args.operationCredential,
-		session: args.session,
-		requiredCapability: args.requiredCapability,
-		materialActivation: args.materialActivation,
-		ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
-		relayerKeyId,
-		authority: args.selected.authority,
-		authMethod: args.selected.authMethod,
-		holderRuntime: args.holderRuntime,
-		normalSigning,
-		key,
-		publicFacts
-	};
-	if (args.selected.authMethod.kind === "passkey") {
-		const auth = {
-			kind: "passkey",
-			rpId: toRpId(args.selected.authMethod.rpId),
-			credentialIdB64u: args.selected.authMethod.credentialIdB64u
-		};
-		if (!isPasskeyWalletAuthAuthority(args.factorAuthority) || args.factorAuthority.walletId !== key.walletId || args.factorAuthority.bindingId !== args.selected.authMethod.walletAuthMethodId || args.factorAuthority.factor.credentialIdB64u !== auth.credentialIdB64u || String(args.factorAuthority.verifier.rpId) !== String(auth.rpId)) return blocked("authority_identity_mismatch");
-		const resolvedKey = buildResolvedEvmFamilyEcdsaKey({
-			walletId: key.walletId,
-			publicFacts,
-			authBinding: buildPasskeyEcdsaAuthBinding({
-				rpId: auth.rpId,
-				credentialIdB64u: auth.credentialIdB64u
-			})
-		});
-		return {
-			...runtime,
-			auth,
-			factorAuthority: args.factorAuthority,
-			resolvedKey
-		};
-	}
-	if (!isEmailOtpWalletAuthAuthority(args.factorAuthority) || args.factorAuthority.walletId !== key.walletId || args.factorAuthority.bindingId !== args.selected.authMethod.walletAuthMethodId || args.factorAuthority.verifier.emailHashHex !== args.selected.authMethod.emailHashHex) return blocked("authority_identity_mismatch");
-	const auth = {
-		kind: "email_otp",
-		providerSubjectId: String(args.factorAuthority.factor.providerUserId)
-	};
-	return {
-		...runtime,
-		auth,
-		factorAuthority: args.factorAuthority
-	};
-}
-function projectActiveRuntime(args) {
-	if (!args.chainTarget) return null;
-	const lane = {
-		kind: "active_wallet_authority_ecdsa_lane_projection_v1",
-		source: "active_wallet_authority",
-		chainTarget: args.chainTarget,
-		runtime: args.runtime,
-		key: args.runtime.key,
-		materialActivation: args.runtime.materialActivation,
-		publicFacts: args.runtime.publicFacts,
-		state: "deferred",
-		authorizationState: "authorization_required"
-	};
-	if (args.runtime.auth.kind === "passkey") {
-		if (!args.runtime.resolvedKey) return null;
-		return {
-			...lane,
-			auth: args.runtime.auth,
-			resolvedKey: args.runtime.resolvedKey
-		};
-	}
-	return {
-		...lane,
-		auth: args.runtime.auth
-	};
-}
-async function resolveActiveWalletAuthorityEcdsaRuntimeV1(args) {
-	const { input, ports } = args;
-	const requiredCapability = input.requiredCapability || "sign";
-	const nowMs = Math.floor(Number(input.nowMs) || Date.now());
-	let walletId;
-	try {
-		walletId = toWalletId(input.walletId);
-	} catch (error) {
-		return blocked("invalid_selected_authority", error instanceof Error ? error.message : String(error));
-	}
-	let selectedResult;
-	try {
-		selectedResult = await ports.resolveSelectedWalletAuthority(String(walletId));
-	} catch (error) {
-		return blocked("persistence_unavailable", error instanceof Error ? error.message : String(error));
-	}
-	const selected = exactAuthorityResolution(selectedResult);
-	if ("kind" in selected) return selected;
-	const ecdsaActivation = activeAuthorityEcdsaActivation(selected.authority);
-	if (!ecdsaActivation) return blocked("missing_ecdsa_signer");
-	const signer = ecdsaActivation.ecdsa.signer;
-	const materialActivation = ecdsaActivation.ecdsa.materialActivation;
-	if (input.materialActivation && !mpcMaterialActivationRefsEqual(input.materialActivation, materialActivation)) return blocked("authority_identity_mismatch");
-	const linkedMaterial = exactEcdsaSignerMaterial({
-		materials: selected.signerMaterials,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		materialActivation
-	});
-	if (!linkedMaterial || !linkedMaterialTargetFactorMatches({
-		material: linkedMaterial,
-		authMethod: selected.authMethod
-	})) return blocked("missing_holder_runtime");
-	if (String(linkedMaterial.publicFacts.ecdsaThresholdKeyId) !== String(linkedMaterial.ecdsaThresholdKeyId)) return blocked("holder_runtime_identity_mismatch");
-	const holderRuntime = exactHolderRuntime({
-		walletId,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		materialActivation,
-		ecdsaThresholdKeyId: String(linkedMaterial.ecdsaThresholdKeyId),
-		material: linkedMaterial
-	});
-	if (!holderRuntime) return blocked("holder_runtime_identity_mismatch");
-	let sessionWithCredential;
-	try {
-		sessionWithCredential = await ports.readExactWithOperationCredential({
-			walletId,
-			authorityId: selected.authority.authorityId,
-			authMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch (error) {
-		return blocked("persistence_unavailable", error instanceof Error ? error.message : String(error));
-	}
-	switch (sessionWithCredential.kind) {
-		case "found": break;
-		case "missing": return blocked("missing_wallet_session");
-		case "upgrade_required": return blocked("upgrade_required", "Wallet Session authorization requires a newer client");
-	}
-	const session = sessionWithCredential.record;
-	const operationCredential = sessionWithCredential.operationCredential;
-	if (session.expiresAtMs <= nowMs) return blocked("wallet_session_expired");
-	if (session.walletId !== walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || operationCredential.walletSessionId.length === 0 || operationCredential.token.trim().length === 0) return blocked("wallet_session_identity_mismatch");
-	if (!exactSessionCapability({
-		session,
-		capability: requiredCapability,
-		materialActivation
-	})) return blocked("wallet_session_capability_mismatch");
-	const factorAuthority = holderRuntime.factorAuthority;
-	const runtime = await buildActiveRuntime({
-		selected,
-		session,
-		operationCredential,
-		requiredCapability,
-		signer,
-		materialActivation,
-		holderRuntime,
-		factorAuthority
-	});
-	if (runtime.kind !== "active_wallet_authority_ecdsa_runtime_v1") return runtime;
-	return {
-		kind: "resolved",
-		runtime,
-		lane: projectActiveRuntime({
-			runtime,
-			chainTarget: input.chainTarget
-		})
-	};
-}
-//#endregion
-export { resolveActiveWalletAuthorityEcdsaRuntimeV1 };
-
-//# sourceMappingURL=activeWalletAuthorityEcdsaRuntime.js.map