@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/signingEngine/session/passkey/ed25519YaoSealedSession.js

@@ -1,57 +0,0 @@
-import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-//#region src/core/signingEngine/session/passkey/ed25519YaoSealedSession.ts
-function buildPasskeyEd25519RestoreMetadata(args) {
-	const rpId = String(args.rpId).trim();
-	const nearAccountId = String(args.nearAccountId).trim();
-	const nearEd25519SigningKeyId = String(args.nearEd25519SigningKeyId).trim();
-	const relayerKeyId = String(args.relayerKeyId).trim();
-	const credentialIdB64u = String(args.credentialIdB64u).trim();
-	const participantIds = normalizeThresholdEd25519ParticipantIds(args.participantIds);
-	const signerSlot = Math.floor(Number(args.signerSlot));
-	if (!rpId || !nearAccountId || !nearEd25519SigningKeyId || !relayerKeyId || !credentialIdB64u || !participantIds || !Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("Passkey Ed25519 sealed restore metadata is incomplete");
-	return {
-		rpId,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		relayerKeyId,
-		participantIds: [...participantIds],
-		runtimePolicyScope: args.runtimePolicyScope,
-		signerSlot,
-		routerAbNormalSigning: args.routerAbNormalSigning,
-		credentialIdB64u,
-		materialActivation: args.materialActivation
-	};
-}
-async function persistPasskeyEd25519YaoSessionForRefresh(input) {
-	const thresholdSessionId = String(input.session.thresholdSessionId || "").trim();
-	const walletSessionToken = String(input.session.walletSessionAuth.walletSessionToken || "").trim();
-	const walletId = String(input.session.signingLane.identity.signer.account.wallet.walletId || "").trim();
-	const prfFirstB64u = String(input.prfFirstB64u || "").trim();
-	const expiresAtMs = Math.floor(Number(input.session.signingWalletSession.expiresAtMs) || 0);
-	const remainingUses = Math.floor(Number(input.session.remainingUses));
-	const laneAuth = input.session.signingLane.identity.auth;
-	if (laneAuth.kind !== "passkey") throw new Error("Ed25519 Yao sealed refresh persistence requires a passkey lane");
-	if (!thresholdSessionId || !walletSessionToken || !walletId || !prfFirstB64u || expiresAtMs <= 0 || !Number.isSafeInteger(remainingUses) || remainingUses < 0) throw new Error("Ed25519 Yao sealed refresh persistence received an invalid session");
-	const signer = input.session.signingLane.identity.signer;
-	if (walletId !== String(signer.account.wallet.walletId) || input.ed25519Restore.nearAccountId !== String(signer.account.nearAccountId) || input.ed25519Restore.nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || input.ed25519Restore.signerSlot !== signer.signerSlot || input.ed25519Restore.rpId !== String(laneAuth.rpId) || input.ed25519Restore.credentialIdB64u !== laneAuth.credentialIdB64u || !mpcMaterialActivationRefsEqual(input.ed25519Restore.materialActivation, input.materialActivation) || input.ed25519Restore.routerAbNormalSigning?.signingWorkerId !== input.session.routerAbNormalSigning.signingWorkerId) throw new Error("Ed25519 Yao sealed refresh metadata does not match the exact session");
-	const transport = {
-		curve: "ed25519",
-		authMethod: "passkey",
-		walletId,
-		relayerUrl: input.session.relayerUrl,
-		walletSessionToken,
-		ed25519Restore: input.ed25519Restore
-	};
-	await input.persistence.hydrateSigningSession({
-		thresholdSessionId,
-		prfFirstB64u,
-		expiresAtMs,
-		remainingUses,
-		transport
-	});
-}
-//#endregion
-export { buildPasskeyEd25519RestoreMetadata, persistPasskeyEd25519YaoSessionForRefresh };
-
-//# sourceMappingURL=ed25519YaoSealedSession.js.map

package/dist/esm/react/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.js

@@ -1,317 +0,0 @@
-import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { isPlainObject, requireRecord, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { toAccountId } from "../../../types/accountIds.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseEd25519YaoRecoveryCapabilityV1 } from "./ed25519YaoRecoveryCapability.js";
-import { assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity } from "../../flows/recovery/passkeyEd25519YaoRecovery.js";
-import { ed25519DurableMaterialLocator } from "../sealedRecovery/materialActivationKey.js";
-//#region src/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.ts
-function requirePositiveInteger(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
-	return value;
-}
-function requireParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2 || !Number.isSafeInteger(value[0]) || !Number.isSafeInteger(value[1]) || value[0] < 1 || value[1] < 1 || value[0] === value[1]) throw new Error("warm recovery participantIds must contain two distinct positive integers");
-	return [Number(value[0]), Number(value[1])];
-}
-const WARM_RECOVERY_RESPONSE_KEYS = [
-	"capability",
-	"kind",
-	"nearAccountId",
-	"nearEd25519SigningKeyId",
-	"participantIds",
-	"quotaId",
-	"routerAbNormalSigning",
-	"runtimePolicyScope",
-	"signerSlot",
-	"signingWorkerId",
-	"thresholdExpiresAtMs",
-	"thresholdSessionId",
-	"walletId",
-	"walletSessionId"
-];
-function exactResponseKeys(record, expectedFields) {
-	const expected = [...expectedFields].sort();
-	const actual = Object.keys(record).sort();
-	if (actual.length !== expected.length) throw new Error("warm recovery bootstrap response fields are invalid");
-	for (let index = 0; index < actual.length; index += 1) if (actual[index] !== expected[index]) throw new Error("warm recovery bootstrap response fields are invalid");
-}
-function sealedRecordMatchesSubject(record, subject) {
-	if (record.authMethod !== "passkey") return false;
-	const restore = record.ed25519Restore;
-	if (!restore.credentialIdB64u) return false;
-	return record.walletId === subject.walletId && restore.nearAccountId === subject.nearAccountId && restore.nearEd25519SigningKeyId === subject.nearEd25519SigningKeyId && restore.signerSlot === subject.signerSlot && record.thresholdSessionIds.ed25519 === subject.thresholdSessionId;
-}
-async function resolveExactWarmRecoveryRecord(subject, runtime) {
-	const record = await runtime.readExactEd25519SealedSession(ed25519DurableMaterialLocator({
-		authMethod: "passkey",
-		materialActivation: subject.materialActivation
-	}));
-	if (record && (record.curve !== "ed25519" || !sealedRecordMatchesSubject(record, subject) || !mpcMaterialActivationRefsEqual(record.ed25519Restore.materialActivation, subject.materialActivation))) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (!record) return {
-		kind: "unavailable",
-		reason: "sealed_session_missing"
-	};
-	if (record.expiresAtMs <= runtime.nowMs()) return {
-		kind: "unavailable",
-		reason: "sealed_session_expired"
-	};
-	if (record.remainingUses < 1) return {
-		kind: "unavailable",
-		reason: "sealed_session_exhausted"
-	};
-	return {
-		kind: "ready",
-		record
-	};
-}
-async function readExactSelectedPasskeyWalletSessionAuthorization(args) {
-	let selected;
-	try {
-		selected = await args.runtime.resolveSelectedWalletAuthority(String(args.walletId));
-	} catch {
-		return null;
-	}
-	if (selected.kind !== "resolved") return null;
-	const { selection, authMethod, authority } = selected;
-	if (selection.lockState !== "unlocked" || selection.walletId !== args.walletId || args.expectedAuthorityRef.walletId !== args.walletId || selection.walletAuthMethodId !== args.expectedAuthorityRef.walletAuthMethodId || authMethod.kind !== "passkey" || authMethod.status !== "active" || authMethod.walletId !== args.walletId || authMethod.walletAuthMethodId !== args.expectedAuthorityRef.walletAuthMethodId || authMethod.walletAuthorityId !== authority.authorityId || String(authMethod.rpId) !== args.rpId || String(authMethod.credentialIdB64u) !== args.credentialIdB64u || authority.state !== "active" || authority.walletId !== args.walletId) return null;
-	try {
-		return {
-			authorizationRead: await args.runtime.readExactWalletSessionAuthorization({
-				walletId: args.walletId,
-				authorityId: authority.authorityId,
-				authMethodId: authMethod.walletAuthMethodId
-			}),
-			authorityId: authority.authorityId,
-			authorityDigestB64u: authority.authorityDigestB64u,
-			authorityRevocationEpoch: authority.revocationEpoch
-		};
-	} catch {
-		return null;
-	}
-}
-async function requirePasskeyEd25519RestoreAuthorization(args) {
-	if (args.authorizationRead.kind !== "found") return null;
-	const authorization = args.authorizationRead;
-	const record = authorization.record;
-	const matchingSignSubjects = record.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.record.ed25519Restore.materialActivation));
-	if (record.walletId !== args.expectedAuthorityRef.walletId || record.walletId !== args.record.walletId || record.authorityId !== args.expectedAuthorityId || record.authMethodId !== args.expectedAuthorityRef.walletAuthMethodId || String(record.authorityDigestB64u) !== String(args.expectedAuthorityDigestB64u) || record.authorityRevocationEpoch !== args.expectedAuthorityRevocationEpoch || record.expiresAtMs <= args.nowMs || authorization.operationCredential.walletSessionId.trim().length === 0 || authorization.operationCredential.token.trim().length === 0 || matchingSignSubjects.length !== 1) return null;
-	return authorization;
-}
-function ownerWarmRecoveryBootstrapRequest(record, thresholdSessionId) {
-	const restore = record.ed25519Restore;
-	const parsed = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1({
-		kind: "router_ab_ed25519_yao_warm_recovery_bootstrap_request_v1",
-		walletId: record.walletId,
-		nearAccountId: restore.nearAccountId,
-		nearEd25519SigningKeyId: restore.nearEd25519SigningKeyId,
-		signerSlot: restore.signerSlot,
-		thresholdSessionId,
-		signingWorkerId: restore.routerAbNormalSigning.signingWorkerId,
-		participantIds: restore.participantIds
-	});
-	if (!parsed.ok) throw new Error(parsed.message);
-	return parsed.value;
-}
-async function fetchWarmRecoveryBootstrap(args) {
-	const walletSessionToken = args.authorization.operationCredential.token;
-	if (args.authorization.record.walletId !== args.request.walletId || !args.authorization.operationCredential.walletSessionId || !walletSessionToken.trim()) throw new Error("[SigningEngine][near] active Wallet Session authorization does not match sealed material");
-	const response = await args.fetch(`${new URL(args.relayerUrl).origin}${ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${walletSessionToken}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(args.request)
-	});
-	const body = await parseJsonResponseOrNull(response);
-	const parsedBody = isPlainObject(body) ? body : null;
-	if (!response.ok) {
-		const code = parsedBody ? String(parsedBody.code || "").trim() : "";
-		if (response.status === 401 && code === "wallet_session_expired") return {
-			kind: "unavailable",
-			reason: "wallet_session_expired"
-		};
-		const message = parsedBody ? String(parsedBody.message || "").trim() : "";
-		throw new Error(`[SigningEngine][near] Ed25519 warm recovery bootstrap failed (HTTP ${response.status}${code ? `, ${code}` : ""}): ${message || "invalid response"}`);
-	}
-	if (!parsedBody) throw new Error("Ed25519 warm recovery bootstrap returned invalid JSON");
-	return {
-		kind: "ready",
-		descriptor: await parseWarmRecoveryDescriptor({
-			record: args.record,
-			authorization: args.authorization,
-			expectedAuthorityRef: args.expectedAuthorityRef,
-			expectedThresholdSessionId: args.expectedThresholdSessionId,
-			response: parsedBody
-		})
-	};
-}
-async function parseJsonResponseOrNull(response) {
-	try {
-		return await response.json();
-	} catch {
-		return null;
-	}
-}
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-async function parseWarmRecoveryDescriptor(args) {
-	const record = args.record;
-	const response = args.response;
-	exactResponseKeys(response, WARM_RECOVERY_RESPONSE_KEYS);
-	if (response.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("warm recovery bootstrap response kind is invalid");
-	const restore = record.ed25519Restore;
-	const walletId = requireTrimmedString(response.walletId, "response.walletId");
-	const nearAccountId = requireTrimmedString(response.nearAccountId, "response.nearAccountId");
-	const nearEd25519SigningKeyId = requireTrimmedString(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
-	const signerSlot = requirePositiveInteger(response.signerSlot, "response.signerSlot");
-	const thresholdSessionId = requireTrimmedString(response.thresholdSessionId, "response.thresholdSessionId");
-	const signingWorkerId = requireTrimmedString(response.signingWorkerId, "response.signingWorkerId");
-	const thresholdExpiresAtMs = requirePositiveInteger(response.thresholdExpiresAtMs, "response.thresholdExpiresAtMs");
-	const participantIds = requireParticipantIds(response.participantIds);
-	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord(response.runtimePolicyScope, "response.runtimePolicyScope"));
-	const sealedRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord(restore.runtimePolicyScope, "ed25519Restore.runtimePolicyScope"));
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(response.routerAbNormalSigning);
-	const walletSessionId = parseWalletSessionId(response.walletSessionId);
-	const quotaId = parseMpcWalletSigningQuotaId(response.quotaId);
-	const capability = parseEd25519YaoRecoveryCapabilityV1(response.capability);
-	const walletSessionToken = args.authorization.operationCredential.token;
-	if (!walletSessionId.ok || !quotaId.ok || args.expectedAuthorityRef.walletId !== record.walletId || String(walletSessionId.value) !== String(args.authorization.operationCredential.walletSessionId) || String(quotaId.value) !== String(args.authorization.record.quotaId) || !routerAbNormalSigning || walletId !== record.walletId || nearAccountId !== restore.nearAccountId || nearEd25519SigningKeyId !== restore.nearEd25519SigningKeyId || signerSlot !== restore.signerSlot || thresholdSessionId !== String(args.expectedThresholdSessionId) || !walletSessionToken || signingWorkerId !== restore.relayerKeyId || signingWorkerId !== restore.routerAbNormalSigning.signingWorkerId || routerAbNormalSigning.signingWorkerId !== signingWorkerId || record.expiresAtMs > thresholdExpiresAtMs || participantIds[0] !== restore.participantIds[0] || participantIds[1] !== restore.participantIds[1] || !sameRuntimePolicyScope(responseRuntimePolicyScope, sealedRuntimePolicyScope)) throw new Error("warm recovery bootstrap does not match the exact sealed Ed25519 lane");
-	if (!signingRootScopeFromRuntimePolicyScope(responseRuntimePolicyScope)) throw new Error("warm recovery bootstrap signing-root scope is invalid");
-	if (!walletSessionToken) throw new Error("[SigningEngine][near] active Wallet Session authorization is unavailable");
-	const descriptor = {
-		authority: args.expectedAuthorityRef,
-		walletId: walletIdFromString(walletId),
-		nearAccountId: toAccountId(nearAccountId),
-		nearEd25519SigningKeyId,
-		signerSlot,
-		operationalPublicKey: `ed25519:${base58Encode(Uint8Array.from(capability.registeredPublicKey))}`,
-		relayerKeyId: signingWorkerId,
-		credentialIdB64u: requireTrimmedString(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
-		session: {
-			sessionKind: "opaque",
-			walletSessionToken,
-			thresholdSessionId,
-			walletSessionId: walletSessionId.value,
-			authorizationId: args.authorization.record.authorizationId,
-			quotaId: quotaId.value,
-			expiresAtMs: thresholdExpiresAtMs,
-			remainingUses: record.remainingUses,
-			runtimePolicyScope: responseRuntimePolicyScope,
-			participantIds,
-			routerAbNormalSigning
-		},
-		capability
-	};
-	assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity(descriptor, restore.materialActivation);
-	return descriptor;
-}
-async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
-	const exactRecord = await resolveExactWarmRecoveryRecord(input.subject, runtime);
-	if (exactRecord.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: exactRecord.reason
-	};
-	const walletId = parseWalletId(exactRecord.record.walletId);
-	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
-	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
-	let expectedAuthorityRef;
-	try {
-		expectedAuthorityRef = await runtime.resolveExactPasskeyWalletAuthAuthorityRef({
-			walletId: walletId.value,
-			rpId: exactRecord.record.ed25519Restore.rpId,
-			credentialIdB64u
-		});
-	} catch {
-		return {
-			kind: "capability_recovery_required",
-			reason: "wallet_session_expired"
-		};
-	}
-	if (!expectedAuthorityRef) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
-	const selectedAuthorization = await readExactSelectedPasskeyWalletSessionAuthorization({
-		walletId: walletId.value,
-		rpId: exactRecord.record.ed25519Restore.rpId,
-		credentialIdB64u,
-		expectedAuthorityRef,
-		runtime
-	});
-	if (!selectedAuthorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
-	const authorization = await requirePasskeyEd25519RestoreAuthorization({
-		record: exactRecord.record,
-		authorizationRead: selectedAuthorization.authorizationRead,
-		expectedAuthorityRef,
-		expectedAuthorityId: selectedAuthorization.authorityId,
-		expectedAuthorityDigestB64u: selectedAuthorization.authorityDigestB64u,
-		expectedAuthorityRevocationEpoch: selectedAuthorization.authorityRevocationEpoch,
-		nowMs: runtime.nowMs()
-	});
-	if (!authorization) return {
-		kind: "capability_recovery_required",
-		reason: "wallet_session_expired"
-	};
-	const bootstrap = await fetchWarmRecoveryBootstrap({
-		request: ownerWarmRecoveryBootstrapRequest(exactRecord.record, input.subject.thresholdSessionId),
-		authorization,
-		record: exactRecord.record,
-		expectedAuthorityRef,
-		expectedThresholdSessionId: input.subject.thresholdSessionId,
-		relayerUrl: input.relayerUrl,
-		fetch: input.fetch
-	});
-	if (bootstrap.kind === "unavailable") return {
-		kind: "capability_recovery_required",
-		reason: bootstrap.reason
-	};
-	const descriptor = bootstrap.descriptor;
-	const walletCustodyEnvelope = await runtime.readPasskeyCustodySessionEnvelope({
-		walletId: String(descriptor.walletId),
-		credentialIdB64u: descriptor.credentialIdB64u
-	});
-	if (!walletCustodyEnvelope || walletCustodyEnvelope.binding.kind !== "wallet_custody_seed_v1") return {
-		kind: "capability_recovery_required",
-		reason: "wallet_custody_envelope_missing"
-	};
-	return {
-		kind: "ready",
-		context: {
-			kind: "passkey_ed25519_yao_export_context_v1",
-			selectedLaneMaterialActivation: descriptor.capability.materialActivation,
-			material: {
-				authority: descriptor.authority,
-				walletId: descriptor.walletId,
-				nearAccountId: descriptor.nearAccountId,
-				nearEd25519SigningKeyId: descriptor.nearEd25519SigningKeyId,
-				signerSlot: descriptor.signerSlot,
-				operationalPublicKey: descriptor.operationalPublicKey,
-				relayerKeyId: descriptor.relayerKeyId,
-				credentialIdB64u: descriptor.credentialIdB64u,
-				capability: descriptor.capability
-			},
-			authorization,
-			relayerUrl: input.relayerUrl,
-			rpId: exactRecord.record.ed25519Restore.rpId,
-			walletCustodyEnvelope
-		}
-	};
-}
-//#endregion
-export { resolvePasskeyEd25519YaoExportContextV1 };
-
-//# sourceMappingURL=ed25519YaoWarmRecovery.js.map

package/dist/esm/react/core/signingEngine/session/passkey/passkeyCustodySessionCache.js

@@ -1,90 +0,0 @@
-import { isWalletCustodySeedBinding } from "../../../../shared-ts/src/passkey-custody/custodySecretBinding.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../../shared-ts/src/passkey-custody/index.js";
-//#region src/core/signingEngine/session/passkey/passkeyCustodySessionCache.ts
-const PASSKEY_CUSTODY_ENVELOPE_CACHE_KEY = "passkeyCustodyEnvelopeCacheV1";
-const PASSKEY_CUSTODY_ENVELOPE_CACHE_KIND = "passkey_custody_envelope_cache_v1";
-const MAX_CACHED_PASSKEY_CUSTODY_ENVELOPES = 32;
-let persistenceState = { kind: "unconfigured" };
-const activePasskeyCustodyEnvelopes = /* @__PURE__ */ new Map();
-function assertNeverPersistenceState(value) {
-	throw new Error(`unknown passkey custody session cache persistence state: ${String(value)}`);
-}
-function requirePersistence() {
-	switch (persistenceState.kind) {
-		case "configured": return persistenceState.persistence;
-		case "unconfigured": throw new Error("passkey custody session cache persistence is not configured");
-		default: return assertNeverPersistenceState(persistenceState);
-	}
-}
-function configurePasskeyCustodySessionCachePersistence(persistence) {
-	persistenceState = {
-		kind: "configured",
-		persistence
-	};
-}
-function sessionKey(walletId, credentialIdB64u) {
-	const wallet = String(walletId || "").trim();
-	const credential = String(credentialIdB64u || "").trim();
-	if (!wallet || !credential) throw new Error("passkey custody session identity is required");
-	return `${wallet}:${credential}`;
-}
-function emptyEnvelopeCache() {
-	return {
-		kind: PASSKEY_CUSTODY_ENVELOPE_CACHE_KIND,
-		envelopes: []
-	};
-}
-function parseEnvelopeCache(value) {
-	if (value === void 0 || value === null) return emptyEnvelopeCache();
-	if (typeof value !== "object" || Array.isArray(value)) throw new Error("passkey custody envelope cache is invalid");
-	const record = value;
-	if (record.kind !== PASSKEY_CUSTODY_ENVELOPE_CACHE_KIND || !Array.isArray(record.envelopes)) throw new Error("passkey custody envelope cache has an invalid shape");
-	return {
-		kind: PASSKEY_CUSTODY_ENVELOPE_CACHE_KIND,
-		envelopes: record.envelopes.map((envelope) => {
-			const parsed = parsePasskeyCustodyEnvelopeRecord(envelope);
-			if (!isWalletCustodySeedBinding(parsed.binding)) throw new Error("generic passkey custody cache cannot contain an Ed25519 export root");
-			return parsed;
-		})
-	};
-}
-async function readEnvelopeCache() {
-	return parseEnvelopeCache(await requirePersistence().readCacheEntry(PASSKEY_CUSTODY_ENVELOPE_CACHE_KEY));
-}
-async function writeEnvelopeCache(cache) {
-	await requirePersistence().writeCacheEntry(PASSKEY_CUSTODY_ENVELOPE_CACHE_KEY, cache);
-}
-/**
-* Keeps the opaque envelope returned by the authenticated session exchange in
-* this page's memory. The export worker receives it only for the matching
-* wallet/credential and opens it with the fresh PRF output it collected.
-*/
-async function rememberPasskeyCustodySessionEnvelope(args) {
-	if (args.envelope.lifecycle.state !== "active") throw new Error("passkey custody session envelope is not active");
-	if (!isWalletCustodySeedBinding(args.envelope.binding)) throw new Error("generic passkey custody cache accepts wallet custody seeds only");
-	if (String(args.envelope.walletId) !== String(args.walletId) || args.envelope.factor.kind !== "passkey" || String(args.envelope.factor.credentialIdB64u) !== String(args.credentialIdB64u)) throw new Error("passkey custody session envelope identity changed");
-	const key = sessionKey(String(args.walletId), String(args.credentialIdB64u));
-	activePasskeyCustodyEnvelopes.set(key, args.envelope);
-	const envelopes = (await readEnvelopeCache()).envelopes.filter((envelope) => envelope.factor.kind !== "passkey" || sessionKey(String(envelope.walletId), String(envelope.factor.credentialIdB64u)) !== key);
-	envelopes.push(args.envelope);
-	await writeEnvelopeCache({
-		kind: PASSKEY_CUSTODY_ENVELOPE_CACHE_KIND,
-		envelopes: envelopes.slice(-MAX_CACHED_PASSKEY_CUSTODY_ENVELOPES)
-	});
-}
-async function readPasskeyCustodySessionEnvelope(args) {
-	const key = sessionKey(String(args.walletId), String(args.credentialIdB64u));
-	const active = activePasskeyCustodyEnvelopes.get(key);
-	if (active) return active;
-	const cached = (await readEnvelopeCache()).envelopes.find((envelope) => envelope.lifecycle.state === "active" && envelope.factor.kind === "passkey" && sessionKey(String(envelope.walletId), String(envelope.factor.credentialIdB64u)) === key);
-	if (cached) {
-		activePasskeyCustodyEnvelopes.set(key, cached);
-		return cached;
-	}
-	return null;
-}
-//#endregion
-export { configurePasskeyCustodySessionCachePersistence, readPasskeyCustodySessionEnvelope, rememberPasskeyCustodySessionEnvelope };
-
-//# sourceMappingURL=passkeyCustodySessionCache.js.map

package/dist/esm/react/core/signingEngine/session/passkey/prfCache.js

@@ -1,60 +0,0 @@
-import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-//#region src/core/signingEngine/session/passkey/prfCache.ts
-function toNonNegativeInt(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return void 0;
-	return Math.floor(value);
-}
-function generateSessionId(prefix) {
-	return secureRandomId(prefix, 32, "passkey PRF cache session IDs");
-}
-function normalizeSigningSessionCacheEntry(args) {
-	const thresholdSessionId = String(args.thresholdSessionId || "").trim();
-	const prfFirstB64u = String(args.prfFirstB64u || "").trim();
-	const expiresAtMsRaw = Number(args.expiresAtMs);
-	const remainingUses = toNonNegativeInt(args.remainingUses);
-	if (!thresholdSessionId || !prfFirstB64u) throw new Error("Missing thresholdSessionId or prfFirstB64u for signing session hydration");
-	if (!Number.isFinite(expiresAtMsRaw) || expiresAtMsRaw <= 0) throw new Error("Invalid expiresAtMs for signing session hydration");
-	if (remainingUses == null) throw new Error("Invalid remainingUses for signing session hydration");
-	const normalized = {
-		thresholdSessionId,
-		prfFirstB64u,
-		expiresAtMs: Math.floor(expiresAtMsRaw),
-		remainingUses,
-		...args.diagnostics ? { diagnostics: args.diagnostics } : {}
-	};
-	if (args.preparedServerSeal) return {
-		...normalized,
-		transport: args.transport,
-		preparedServerSeal: args.preparedServerSeal
-	};
-	return {
-		...normalized,
-		...args.transport ? { transport: args.transport } : {}
-	};
-}
-async function cacheCredentialBoundarySetupExportPrfFirst(writer, args) {
-	const normalized = normalizeSigningSessionCacheEntry(args);
-	const material = {
-		thresholdSessionId: normalized.thresholdSessionId,
-		prfFirstB64u: normalized.prfFirstB64u,
-		expiresAtMs: normalized.expiresAtMs,
-		remainingUses: normalized.remainingUses,
-		...normalized.diagnostics ? { diagnostics: normalized.diagnostics } : {}
-	};
-	if (normalized.preparedServerSeal) {
-		await writer.putWarmSessionMaterial({
-			...material,
-			transport: normalized.transport,
-			preparedServerSeal: normalized.preparedServerSeal
-		});
-		return;
-	}
-	await writer.putWarmSessionMaterial({
-		...material,
-		...normalized.transport ? { transport: normalized.transport } : {}
-	});
-}
-//#endregion
-export { cacheCredentialBoundarySetupExportPrfFirst, generateSessionId };
-
-//# sourceMappingURL=prfCache.js.map

package/dist/esm/react/core/signingEngine/session/passkey/public.js

@@ -1,15 +0,0 @@
-import { provisionWarmEd25519Capability } from "./ed25519Provisioner.js";
-//#region src/core/signingEngine/session/passkey/public.ts
-async function connectEd25519Session(deps, args) {
-	return await provisionWarmEd25519Capability({
-		getWarmSession: (walletId) => deps.getWarmSession(walletId),
-		provisionThresholdEd25519Session: async (provisionArgs) => await deps.provisionThresholdEd25519Session(provisionArgs)
-	}, args);
-}
-async function bootstrapEcdsaSession(deps, args) {
-	return await deps.bootstrapEcdsaSession(args);
-}
-//#endregion
-export { bootstrapEcdsaSession, connectEd25519Session };
-
-//# sourceMappingURL=public.js.map