@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/signingEngine/session/passkey/ecdsaSessionProvision.js

@@ -1,224 +0,0 @@
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { evmFamilyEcdsaWalletKeyToIdentity } from "../identity/evmFamilyEcdsaIdentity.js";
-import { emailOtpAuthContextRetention } from "../identity/laneIdentity.js";
-import { ecdsaRoleLocalReadyRecordStorageKeyFacts } from "../persistence/ecdsaRoleLocalRecords.js";
-import { bootstrapEcdsaSessionValue, bootstrapEmailOtpExplicitExportEcdsaSessionValue, bootstrapExplicitKeyExportEcdsaSessionValue, ecdsaBootstrapWalletId } from "./ecdsaBootstrap.js";
-import { withThresholdEcdsaBootstrapQueue } from "../warmCapabilities/ecdsaBootstrapQueue.js";
-//#region src/core/signingEngine/session/passkey/ecdsaSessionProvision.ts
-function applyOptionalActivationFields(request, args) {
-	if (args.runtimeScopeBootstrap) request.runtimeScopeBootstrap = args.runtimeScopeBootstrap;
-	if (args.operationIntent) request.operationIntent = args.operationIntent;
-	if (typeof args.ttlMs === "number") request.ttlMs = args.ttlMs;
-	return request;
-}
-function buildEmailOtpEcdsaActivationRequest(args) {
-	return applyOptionalActivationFields({
-		kind: "email_otp_ecdsa_activation",
-		purpose: "transaction_signing",
-		walletKey: args.walletKey,
-		lanePolicy: args.lanePolicy,
-		publicCapability: args.publicCapability,
-		existingRoleLocalMaterial: args.existingRoleLocalMaterial,
-		source: args.source,
-		relayerUrl: args.relayerUrl,
-		sessionIdentity: args.sessionIdentity,
-		sessionKind: args.sessionKind,
-		sessionBudgetUses: args.sessionBudgetUses,
-		runtimePolicy: args.runtimePolicy,
-		emailOtpWorkerSessionHandle: args.emailOtpWorkerSessionHandle,
-		emailOtpAuthContext: args.emailOtpAuthContext,
-		..."preauthorizedSessionActivation" in args ? { preauthorizedSessionActivation: args.preauthorizedSessionActivation } : { walletSessionRouteAuth: args.walletSessionRouteAuth }
-	}, args);
-}
-function assertEmailOtpActivationRetention(args) {
-	if (emailOtpAuthContextRetention(args.context) !== args.expected) throw new Error(`Email OTP ${args.label} activation requires ${args.expected} retention`);
-}
-function buildEmailOtpSessionBootstrapEcdsaActivation(args) {
-	assertEmailOtpActivationRetention({
-		context: args.emailOtpAuthContext,
-		expected: "session",
-		label: "session bootstrap"
-	});
-	return buildEmailOtpEcdsaActivationRequest(args);
-}
-function buildEmailOtpRecoveredSessionEcdsaActivation(args) {
-	assertEmailOtpActivationRetention({
-		context: args.emailOtpAuthContext,
-		expected: "session",
-		label: "recovered session"
-	});
-	return buildEmailOtpEcdsaActivationRequest(args);
-}
-function buildEmailOtpPreauthorizedSessionBootstrapEcdsaActivation(args) {
-	assertEmailOtpActivationRetention({
-		context: args.emailOtpAuthContext,
-		expected: "session",
-		label: "preauthorized session bootstrap"
-	});
-	return buildEmailOtpEcdsaActivationRequest(args);
-}
-function buildEmailOtpPerOperationReauthEcdsaActivation(args) {
-	assertEmailOtpActivationRetention({
-		context: args.emailOtpAuthContext,
-		expected: "single_use",
-		label: "per-operation reauth"
-	});
-	return buildEmailOtpEcdsaActivationRequest(args);
-}
-function buildEmailOtpExplicitExportEcdsaActivation(args) {
-	return {
-		kind: "email_otp_ecdsa_export_activation",
-		purpose: "explicit_key_export",
-		existingRoleLocalMaterial: args.existingRoleLocalMaterial,
-		relayerUrl: args.relayerUrl,
-		authorization: args.authorization
-	};
-}
-function buildEcdsaExportActivation(args) {
-	return {
-		kind: "passkey_ecdsa_export_activation",
-		purpose: "explicit_key_export",
-		existingRoleLocalMaterial: args.existingRoleLocalMaterial,
-		relayerUrl: args.relayerUrl,
-		authorization: args.authorization
-	};
-}
-function toOptionalRuntimePolicyScope(policy) {
-	switch (policy.kind) {
-		case "default_policy": return;
-		case "scoped_policy": return policy.scope;
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported ECDSA activation policy");
-}
-function applyCommonActivationRequestFields(args, request) {
-	if (request.runtimeScopeBootstrap) args.runtimeScopeBootstrap = request.runtimeScopeBootstrap;
-	if (request.operationIntent) args.operationIntent = request.operationIntent;
-	const runtimePolicyScope = toOptionalRuntimePolicyScope(request.runtimePolicy);
-	if ("walletId" in args) {
-		if (typeof request.ttlMs === "number") args.ttlMs = request.ttlMs;
-		if (runtimePolicyScope) args.runtimePolicyScope = runtimePolicyScope;
-	}
-	return args;
-}
-function toEcdsaBootstrapLifecycleCommand(request) {
-	switch (request.kind) {
-		case "passkey_ecdsa_activation": return {
-			kind: "passkey_existing_session_activation",
-			request
-		};
-		case "email_otp_ecdsa_activation": return {
-			kind: "email_otp_existing_session_activation",
-			request
-		};
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported activation request");
-}
-function passkeyCredentialIdFromActivation(request) {
-	const credentialId = String(request.webauthnAuthentication.rawId || request.webauthnAuthentication.id || "").trim();
-	if (!credentialId) throw new Error("[SigningEngine][ecdsa] passkey activation requires credential identity");
-	return credentialId;
-}
-function toBootstrapEcdsaSessionRequest(request) {
-	const command = toEcdsaBootstrapLifecycleCommand(request);
-	switch (command.kind) {
-		case "passkey_existing_session_activation": return applyCommonActivationRequestFields({
-			kind: "passkey_fresh_ecdsa_bootstrap",
-			keyHandle: command.request.walletKey.keyHandle,
-			key: evmFamilyEcdsaWalletKeyToIdentity(command.request.walletKey),
-			lanePolicy: command.request.lanePolicy,
-			publicCapability: command.request.publicCapability,
-			existingRoleLocalMaterial: command.request.existingRoleLocalMaterial,
-			source: command.request.source,
-			relayerUrl: command.request.relayerUrl,
-			requestId: command.request.requestId,
-			passkeyCredentialIdB64u: passkeyCredentialIdFromActivation(command.request),
-			routeAuth: command.request.walletSessionRouteAuth
-		}, command.request);
-		case "email_otp_existing_session_activation": {
-			const common = {
-				kind: "email_otp_ecdsa_bootstrap",
-				keyHandle: command.request.walletKey.keyHandle,
-				key: evmFamilyEcdsaWalletKeyToIdentity(command.request.walletKey),
-				lanePolicy: command.request.lanePolicy,
-				publicCapability: command.request.publicCapability,
-				existingRoleLocalMaterial: command.request.existingRoleLocalMaterial,
-				source: "email_otp",
-				relayerUrl: command.request.relayerUrl,
-				emailOtpWorkerSessionHandle: command.request.emailOtpWorkerSessionHandle,
-				emailOtpAuthContext: command.request.emailOtpAuthContext
-			};
-			return command.request.preauthorizedSessionActivation ? applyCommonActivationRequestFields({
-				...common,
-				sessionActivation: command.request.preauthorizedSessionActivation
-			}, command.request) : applyCommonActivationRequestFields({
-				...common,
-				routeAuth: command.request.walletSessionRouteAuth
-			}, command.request);
-		}
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported activation request");
-}
-function toExplicitKeyExportEcdsaBootstrapRequest(request) {
-	return {
-		kind: "passkey_ecdsa_export_bootstrap",
-		purpose: "explicit_key_export",
-		existingRoleLocalMaterial: request.existingRoleLocalMaterial,
-		relayerUrl: request.relayerUrl,
-		authorization: request.authorization
-	};
-}
-async function persistEcdsaRoleLocalReadyRecordForBootstrap(args) {
-	const binding = args.bootstrap.thresholdEcdsaKeyRef.backendBinding;
-	if (!binding) throw new Error("[WarmSessionStore] threshold ECDSA bootstrap is missing its backend binding");
-	const record = roleLocalReadyRecordForPersistence(binding);
-	if (!record) return;
-	const persisted = await args.deps.persistEcdsaRoleLocalReadyRecord({
-		record,
-		storageKeyFacts: ecdsaRoleLocalReadyRecordStorageKeyFacts(record)
-	});
-	if (!persisted.ok) throw new Error(`[WarmSessionStore] threshold ECDSA role-local ready record persistence failed (${persisted.code}): ${persisted.message}`);
-}
-function roleLocalReadyRecordForPersistence(binding) {
-	switch (binding.materialKind) {
-		case "role_local_ready_state_blob": return binding.ecdsaRoleLocalReadyRecord;
-		case "role_local_worker_handle":
-		case "role_local_durable_public_anchor":
-		case "role_local_durable_sealed_ref":
-		case "metadata_only": return null;
-		default: {
-			const exhaustive = binding;
-			throw new Error(`[WarmSessionStore] unsupported threshold ECDSA backend binding: ${JSON.stringify(exhaustive)}`);
-		}
-	}
-}
-async function provisionThresholdEcdsaSessionFromBootstrapArgs(deps, request) {
-	const walletId = toWalletId(ecdsaBootstrapWalletId(request));
-	return await withThresholdEcdsaBootstrapQueue(deps.queueByWallet, walletId, async () => {
-		const bootstrap = await bootstrapEcdsaSessionValue(deps.activationDeps, request);
-		await persistEcdsaRoleLocalReadyRecordForBootstrap({
-			deps,
-			bootstrap
-		});
-		return bootstrap;
-	});
-}
-async function provisionThresholdEcdsaSession(deps, request) {
-	return await provisionThresholdEcdsaSessionFromBootstrapArgs(deps, toBootstrapEcdsaSessionRequest(request));
-}
-async function provisionPasskeyEcdsaExplicitExportSession(deps, request) {
-	return await bootstrapExplicitKeyExportEcdsaSessionValue(deps.activationDeps, toExplicitKeyExportEcdsaBootstrapRequest(request));
-}
-async function provisionEmailOtpEcdsaExplicitExportSession(deps, request) {
-	const bootstrapRequest = {
-		kind: "email_otp_ecdsa_export_bootstrap",
-		purpose: "explicit_key_export",
-		existingRoleLocalMaterial: request.existingRoleLocalMaterial,
-		relayerUrl: request.relayerUrl,
-		authorization: request.authorization
-	};
-	return await bootstrapEmailOtpExplicitExportEcdsaSessionValue(deps.activationDeps, bootstrapRequest);
-}
-//#endregion
-export { buildEcdsaExportActivation, buildEmailOtpExplicitExportEcdsaActivation, buildEmailOtpPerOperationReauthEcdsaActivation, buildEmailOtpPreauthorizedSessionBootstrapEcdsaActivation, buildEmailOtpRecoveredSessionEcdsaActivation, buildEmailOtpSessionBootstrapEcdsaActivation, provisionEmailOtpEcdsaExplicitExportSession, provisionPasskeyEcdsaExplicitExportSession, provisionThresholdEcdsaSession, provisionThresholdEcdsaSessionFromBootstrapArgs };
-
-//# sourceMappingURL=ecdsaSessionProvision.js.map

package/dist/esm/react/core/signingEngine/session/passkey/ecdsaWarmCapabilityBootstrap.js

@@ -1,147 +0,0 @@
-import { SigningOperationIntent } from "../operationState/types.js";
-import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { walletSessionFailureFromError } from "../lifecycle/walletSessionFailure.js";
-import { ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap } from "../warmCapabilities/sealedRefreshParity.js";
-import { ecdsaBootstrapChainTarget, ecdsaBootstrapWalletId } from "./ecdsaBootstrap.js";
-import { provisionThresholdEcdsaSessionFromBootstrapArgs } from "./ecdsaSessionProvision.js";
-//#region src/core/signingEngine/session/passkey/ecdsaWarmCapabilityBootstrap.ts
-function createProvisionThresholdEcdsaSessionDeps(deps) {
-	return {
-		queueByWallet: deps.queueByWallet,
-		activationDeps: deps.activationDeps,
-		persistEcdsaRoleLocalReadyRecord: deps.persistEcdsaRoleLocalReadyRecord
-	};
-}
-function createNoPromptWarmSessionDeps(deps) {
-	return {
-		getWarmSession: (walletId) => deps.capabilityReader.getWarmSession(walletId),
-		discoverPersistedSessionsForWallet: deps.passkeyMpcSession.discoverPersistedSessionsForWallet.bind(deps.passkeyMpcSession)
-	};
-}
-function parityArgsFromBootstrapRequest(request) {
-	const walletId = ecdsaBootstrapWalletId(request);
-	const chainTarget = ecdsaBootstrapChainTarget(request);
-	if (request.source === "registration") return {
-		kind: "key_enrollment_bootstrap_parity",
-		walletId,
-		chainTarget
-	};
-	if (request.operationIntent === SigningOperationIntent.TransactionSign) return {
-		kind: "transaction_bootstrap_parity",
-		walletId,
-		chainTarget,
-		operationIntent: SigningOperationIntent.TransactionSign
-	};
-	if (request.kind === "email_otp_ecdsa_bootstrap") return {
-		kind: "email_otp_bootstrap_parity",
-		walletId,
-		chainTarget,
-		authMethod: "email_otp"
-	};
-	return {
-		kind: "default_bootstrap_parity",
-		walletId,
-		chainTarget
-	};
-}
-async function bootstrapDirectEcdsaRequest(deps, request) {
-	return await provisionThresholdEcdsaSessionFromBootstrapArgs(createProvisionThresholdEcdsaSessionDeps(deps), request);
-}
-function sealedRestoreFailureFromError(args) {
-	const errorMessage = args.error instanceof Error ? args.error.message : String(args.error || "unknown error");
-	return {
-		ok: false,
-		code: sealedRestoreFailureCodeFromError(args.error),
-		chainTargetKey: args.chainTargetKey,
-		errorMessage
-	};
-}
-function sealedRestoreFailureCodeFromError(error) {
-	const walletSessionFailure = walletSessionFailureFromError(error);
-	if (walletSessionFailure) switch (walletSessionFailure.kind) {
-		case "expired": return "sealed_record_expired";
-		case "exhausted": return "sealed_record_exhausted";
-		case "missing":
-		case "invalid":
-		case "unavailable": return "sealed_restore_failed";
-	}
-	switch (error && typeof error === "object" ? Reflect.get(error, "code") : void 0) {
-		case "expired": return "sealed_record_expired";
-		case "exhausted": return "sealed_record_exhausted";
-		default: return "sealed_restore_failed";
-	}
-}
-async function bootstrapReuseWarmEcdsaCapabilityNoPrompt(deps, walletId, request) {
-	const chainTarget = request.chainTarget;
-	const chainTargetKey = thresholdEcdsaChainTargetKey(chainTarget);
-	if ((await deps.getWarmSession(walletId)).capabilities.ed25519.state !== "ready") return {
-		ok: false,
-		code: "missing_exact_material",
-		chainTargetKey
-	};
-	try {
-		await deps.discoverPersistedSessionsForWallet({
-			kind: "discover_wallet_ecdsa_signing_sessions",
-			walletId,
-			ecdsaChainTargets: [chainTarget],
-			maxRecords: 1
-		});
-	} catch (error) {
-		console.warn("[SigningEngine][ecdsa] reuse warm sealed discovery failed", {
-			walletId,
-			chainTarget,
-			error: error instanceof Error ? error.message : String(error || "unknown error")
-		});
-		return sealedRestoreFailureFromError({
-			chainTargetKey,
-			error
-		});
-	}
-	return {
-		ok: false,
-		code: "missing_exact_material",
-		chainTargetKey
-	};
-}
-function reuseWarmEcdsaBootstrapFailureMessage(result) {
-	switch (result.code) {
-		case "missing_exact_material": return `[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap requires restored passkey ECDSA material for ${result.chainTargetKey}`;
-		case "sealed_restore_failed": return `[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed restore failed for ${result.chainTargetKey}: ${result.errorMessage || "unknown error"}`;
-		case "sealed_record_expired": return `[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed record expired for ${result.chainTargetKey}`;
-		case "sealed_record_exhausted": return `[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap sealed record exhausted for ${result.chainTargetKey}`;
-	}
-	return "[SigningEngine][ecdsa] reuse_warm_ecdsa_bootstrap failed";
-}
-function reuseWarmEcdsaBootstrapFailureToError(result) {
-	return new Error(reuseWarmEcdsaBootstrapFailureMessage(result));
-}
-async function bootstrapWarmEcdsaCapabilityResult(deps, request) {
-	await ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap(deps.ensureSealedRefreshStartupParity, parityArgsFromBootstrapRequest(request));
-	const walletId = toWalletId(ecdsaBootstrapWalletId(request));
-	switch (request.kind) {
-		case "reuse_warm_ecdsa_bootstrap": {
-			const result = await bootstrapReuseWarmEcdsaCapabilityNoPrompt(createNoPromptWarmSessionDeps(deps), walletId, request);
-			if (result.ok) return {
-				ok: true,
-				bootstrap: result.bootstrap
-			};
-			return {
-				ok: false,
-				kind: "reuse_failed",
-				failure: result
-			};
-		}
-		case "passkey_fresh_ecdsa_bootstrap":
-		case "passkey_preauthorized_ecdsa_bootstrap":
-		case "wallet_session_reconnect_ecdsa_bootstrap":
-		case "email_otp_ecdsa_bootstrap": return {
-			ok: true,
-			bootstrap: await bootstrapDirectEcdsaRequest(deps, request)
-		};
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported warm bootstrap request");
-}
-//#endregion
-export { bootstrapWarmEcdsaCapabilityResult, reuseWarmEcdsaBootstrapFailureToError };
-
-//# sourceMappingURL=ecdsaWarmCapabilityBootstrap.js.map

package/dist/esm/react/core/signingEngine/session/passkey/ed25519Provisioner.js

@@ -1,55 +0,0 @@
-import { toWalletId } from "../../interfaces/ecdsaChainTarget.js";
-import { nearProtocolProjectionFromExactLane } from "../identity/exactSigningLaneIdentity.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { emitWarmSessionTransition, summarizeWarmSessionTransition } from "../warmCapabilities/transitions.js";
-//#region src/core/signingEngine/session/passkey/ed25519Provisioner.ts
-function toOptionalNonEmptyString(value) {
-	return String(value || "").trim() || void 0;
-}
-function assertPersistedEd25519WarmSessionRecord(args) {
-	const persistedSessionId = String(args.persistedSessionIdRaw || "").trim();
-	if (persistedSessionId === args.expectedThresholdSessionId) return;
-	throw new Error(`[WarmSessionStore] provisioned Ed25519 capability was not persisted for ${args.walletId} (expected thresholdSessionId=${args.expectedThresholdSessionId}, found=${persistedSessionId || "missing"})`);
-}
-function walletIdFromEd25519ProvisionArgs(args) {
-	if (args.kind === "exact_ed25519_provisioning") return toWalletId(nearProtocolProjectionFromExactLane(args.laneIdentity, "exact Ed25519 capability provisioning").walletId);
-	return toWalletId(args.walletId);
-}
-function nearAccountIdFromEd25519ProvisionArgs(args) {
-	return toAccountId(args.kind === "exact_ed25519_provisioning" ? nearProtocolProjectionFromExactLane(args.laneIdentity, "exact Ed25519 capability provisioning").nearAccountId : args.nearAccountId);
-}
-async function provisionWarmEd25519Capability(deps, args) {
-	const nearAccountId = nearAccountIdFromEd25519ProvisionArgs(args);
-	const walletId = walletIdFromEd25519ProvisionArgs(args);
-	if (!walletId) throw new Error("[WarmSessionStore] walletId is required to provision Ed25519 capability");
-	if (typeof deps.provisionThresholdEd25519Session !== "function") throw new Error("[WarmSessionStore] provisionThresholdEd25519Session is required to provision Ed25519 capability");
-	const beforeWarmSession = await deps.getWarmSession(walletId);
-	await args.beforeProvision?.();
-	args.assertNotCancelled?.();
-	const provisioned = await deps.provisionThresholdEd25519Session(args);
-	args.assertNotCancelled?.();
-	if (!provisioned.ok) return provisioned;
-	const expectedThresholdSessionId = toOptionalNonEmptyString(provisioned.thresholdSessionId);
-	if (!expectedThresholdSessionId) throw new Error(`[WarmSessionStore] provisioned Ed25519 capability is missing thresholdSessionId for ${nearAccountId}`);
-	const afterWarmSession = await deps.getWarmSession(walletId);
-	assertPersistedEd25519WarmSessionRecord({
-		walletId,
-		expectedThresholdSessionId,
-		persistedSessionIdRaw: afterWarmSession.capabilities.ed25519.runtime?.thresholdSessionId
-	});
-	emitWarmSessionTransition({
-		onTransition: deps.onTransition,
-		event: {
-			type: "ed25519_capability_provisioned",
-			walletId,
-			thresholdSessionId: expectedThresholdSessionId,
-			before: summarizeWarmSessionTransition(beforeWarmSession),
-			after: summarizeWarmSessionTransition(afterWarmSession)
-		}
-	});
-	return provisioned;
-}
-//#endregion
-export { provisionWarmEd25519Capability };
-
-//# sourceMappingURL=ed25519Provisioner.js.map

package/dist/esm/react/core/signingEngine/session/passkey/ed25519SessionProvision.js

@@ -1,229 +0,0 @@
-import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import { nearProtocolProjectionFromExactLane } from "../identity/exactSigningLaneIdentity.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { buildPasskeyEd25519RestoreMetadata } from "./ed25519YaoSealedSession.js";
-import { cacheCredentialBoundarySetupExportPrfFirst, generateSessionId } from "./prfCache.js";
-import { connectEd25519Session } from "../../threshold/ed25519/connectSession.js";
-//#region src/core/signingEngine/session/passkey/ed25519SessionProvision.ts
-function sealTransportForProvisionedEd25519Session(args) {
-	return {
-		curve: "ed25519",
-		authMethod: "passkey",
-		walletId: args.walletId,
-		relayerUrl: args.relayerUrl,
-		walletSessionToken: args.walletSessionToken,
-		ed25519Restore: args.ed25519Restore
-	};
-}
-function passkeyCredentialIdB64uFromAuthority(authority) {
-	const credentialIdB64u = String(authority.authority.factor.credentialIdB64u || "").trim();
-	if (!credentialIdB64u) throw new Error("[threshold-ed25519] passkey authority credential id is required");
-	return credentialIdB64u;
-}
-function resolveEd25519ProvisionProtocol(args) {
-	switch (args.kind) {
-		case "fresh_ed25519_provisioning": return {
-			kind: "fresh",
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			signerSlot: args.signerSlot,
-			thresholdSessionId: SigningSessionIds.thresholdEd25519Session(generateSessionId("threshold-ed25519"))
-		};
-		case "exact_ed25519_provisioning": {
-			const projection = nearProtocolProjectionFromExactLane(args.laneIdentity, "exact Ed25519 capability provisioning");
-			return {
-				kind: "exact",
-				walletId: String(projection.walletId),
-				nearAccountId: projection.nearAccountId,
-				nearEd25519SigningKeyId: String(projection.nearEd25519SigningKeyId),
-				signerSlot: projection.signerSlot,
-				thresholdSessionId: args.laneIdentity.thresholdSessionId,
-				walletSessionId: args.laneIdentity.walletSessionId,
-				quotaId: args.laneIdentity.quotaId
-			};
-		}
-	}
-	throw new Error("[threshold-ed25519] unsupported Ed25519 provisioning kind");
-}
-function exactEd25519ProvisionReturnedDifferentIdentity(args) {
-	switch (args.requested.kind) {
-		case "fresh": return false;
-		case "exact": return args.returnedThresholdSessionId !== args.requested.thresholdSessionId || args.returnedWalletSessionId !== args.requested.walletSessionId || args.returnedQuotaId !== args.requested.quotaId;
-	}
-	args.requested;
-	throw new Error("[threshold-ed25519] unsupported resolved provisioning identity");
-}
-function resolveEd25519ProvisionOperationCredential(args) {
-	switch (args.connected.sessionKind) {
-		case "issued_exact_wallet_session":
-			if (args.connected.operationCredential.walletSessionId !== args.connected.walletSessionId) return {
-				ok: false,
-				code: "invalid_result",
-				message: "Threshold Ed25519 session mint credential does not identify its session"
-			};
-			return {
-				ok: true,
-				operationCredential: args.connected.operationCredential
-			};
-		case "already_committed_exact_wallet_session": {
-			if (args.protocol.kind !== "exact" || !args.existingOperationCredential) return {
-				ok: false,
-				code: "unlock_exact_method",
-				message: "Threshold Ed25519 session reuse returned no credential; exact-method unlock is required"
-			};
-			const operationCredential = args.existingOperationCredential;
-			if (operationCredential.walletSessionId !== args.connected.walletSessionId) return {
-				ok: false,
-				code: "unlock_exact_method",
-				message: "Threshold Ed25519 reused session credential identifies another session"
-			};
-			return {
-				ok: true,
-				operationCredential
-			};
-		}
-		default: return assertNeverEd25519ProvisionSessionKind(args.connected);
-	}
-}
-function assertNeverEd25519ProvisionSessionKind(value) {
-	throw new Error(`[threshold-ed25519] unsupported connected session kind: ${String(value)}`);
-}
-async function provisionThresholdEd25519Session(deps, args) {
-	const protocol = resolveEd25519ProvisionProtocol(args);
-	if (args.kind === "exact_ed25519_provisioning" && args.operationCredential.walletSessionId !== args.laneIdentity.walletSessionId) return {
-		ok: false,
-		code: "invalid_args",
-		message: "Threshold Ed25519 exact credential identifies another Wallet Session"
-	};
-	const nearAccountId = toAccountId(protocol.nearAccountId);
-	const relayerUrl = String(args.relayerUrl || deps.defaultRelayerUrl || "").trim();
-	const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);
-	if (!relayerUrl) throw new Error("Missing relayer url (configs.network.relayer.url)");
-	if (!participantIds) throw new Error("Missing participantIds for threshold Ed25519 session provision");
-	const workerCtx = deps.getSignerWorkerContext();
-	const connected = await connectEd25519Session({
-		credentialStore: deps.credentialStore,
-		touchIdPrompt: deps.touchIdPrompt,
-		relayerUrl,
-		relayerKeyId: args.relayerKeyId,
-		walletId: protocol.walletId,
-		nearEd25519SigningKeyId: protocol.nearEd25519SigningKeyId,
-		authority: args.authority,
-		...args.auth ? { auth: args.auth } : {},
-		...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {},
-		routerAbNormalSigning: args.routerAbNormalSigning,
-		...args.runtimeScopeBootstrap ? { runtimeScopeBootstrap: args.runtimeScopeBootstrap } : {},
-		nearAccountId,
-		participantIds,
-		thresholdSessionId: protocol.thresholdSessionId,
-		ttlMs: args.ttlMs,
-		remainingUses: args.remainingUses,
-		workerCtx,
-		...args.kind === "exact_ed25519_provisioning" ? { existingOperationCredential: args.operationCredential } : {}
-	});
-	if (!connected.ok) return {
-		ok: false,
-		code: String(connected.code || "worker_error").trim() || "worker_error",
-		message: String(connected.message || "").trim() || "Threshold Ed25519 session mint failed"
-	};
-	const resolvedThresholdSessionId = connected.thresholdSessionId || protocol.thresholdSessionId;
-	const expiresAtMs = Number(connected.expiresAtMs);
-	const remainingUses = Number(connected.remainingUses);
-	const prfFirstB64u = String(connected.passkeyPrfFirstB64u || "").trim();
-	const runtimePolicyScope = connected.runtimePolicyScope;
-	if (!resolvedThresholdSessionId || !connected.walletSessionId || !connected.authorizationId || !connected.quotaId || !Number.isFinite(expiresAtMs) || !Number.isFinite(remainingUses)) return {
-		ok: false,
-		code: "invalid_result",
-		message: "Threshold Ed25519 session mint returned incomplete public session metadata"
-	};
-	if (exactEd25519ProvisionReturnedDifferentIdentity({
-		requested: protocol,
-		returnedThresholdSessionId: resolvedThresholdSessionId,
-		returnedWalletSessionId: connected.walletSessionId,
-		returnedQuotaId: connected.quotaId
-	})) return {
-		ok: false,
-		code: "invalid_result",
-		message: "Threshold Ed25519 exact provisioning returned a different lifecycle identity"
-	};
-	const credentialResolution = resolveEd25519ProvisionOperationCredential({
-		connected,
-		protocol,
-		existingOperationCredential: args.kind === "exact_ed25519_provisioning" ? args.operationCredential : void 0
-	});
-	if (!credentialResolution.ok) return credentialResolution;
-	const { operationCredential } = credentialResolution;
-	const walletSessionToken = operationCredential.token;
-	const mintedAuthority = {
-		kind: "minted_ed25519_wallet_session_authority",
-		thresholdSessionId: resolvedThresholdSessionId,
-		walletSessionId: connected.walletSessionId,
-		authorizationId: connected.authorizationId,
-		quotaId: connected.quotaId,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope,
-		operationCredential
-	};
-	const rpId = deps.touchIdPrompt.getRpId();
-	if (prfFirstB64u && args.source === "email_otp") return {
-		ok: false,
-		code: "invalid_result",
-		message: "Passkey PRF material cannot seal an Email OTP Ed25519 session"
-	};
-	await args.onWalletSessionAuthorityReady?.(mintedAuthority);
-	if (prfFirstB64u && args.source !== "email_otp") {
-		const credentialIdB64u = passkeyCredentialIdB64uFromAuthority(args.authority);
-		const ed25519Restore = buildPasskeyEd25519RestoreMetadata({
-			rpId,
-			nearAccountId: String(nearAccountId),
-			nearEd25519SigningKeyId: protocol.nearEd25519SigningKeyId,
-			relayerKeyId: args.relayerKeyId,
-			participantIds,
-			runtimePolicyScope,
-			signerSlot: protocol.signerSlot,
-			routerAbNormalSigning: args.routerAbNormalSigning,
-			credentialIdB64u,
-			materialActivation: args.materialActivation
-		});
-		const transport = sealTransportForProvisionedEd25519Session({
-			walletId: protocol.walletId,
-			relayerUrl,
-			walletSessionToken,
-			ed25519Restore
-		});
-		try {
-			await cacheCredentialBoundarySetupExportPrfFirst(deps.touchConfirm, {
-				thresholdSessionId: String(resolvedThresholdSessionId),
-				prfFirstB64u,
-				expiresAtMs,
-				remainingUses,
-				transport
-			});
-		} catch (error) {
-			return {
-				ok: false,
-				code: "warm_session_cache_failed",
-				message: String(error && typeof error === "object" && "message" in error ? error.message : error || "").trim() || "Threshold Ed25519 session material could not be cached"
-			};
-		}
-	}
-	return {
-		ok: true,
-		sessionKind: connected.sessionKind,
-		thresholdSessionId: resolvedThresholdSessionId,
-		walletSessionId: connected.walletSessionId,
-		authorizationId: connected.authorizationId,
-		quotaId: connected.quotaId,
-		expiresAtMs,
-		remainingUses,
-		runtimePolicyScope,
-		operationCredential
-	};
-}
-//#endregion
-export { provisionThresholdEd25519Session };
-
-//# sourceMappingURL=ed25519SessionProvision.js.map