@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/react/core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.js

@@ -1,256 +0,0 @@
-import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
-import { SigningSessionIds } from "../operationState/types.js";
-import { buildNearTransactionSigningLane } from "../operationState/lanes.js";
-import { requiredSigningSubjectForExactSigningLane, resolveExactWalletSessionOperationCredential } from "../identity/exactWalletSessionCredential.js";
-import { buildRouterAbEd25519SigningWalletSession } from "../routerAbSigningWalletSession.js";
-import { ed25519SealedRuntimeAuthorityRef } from "./ed25519SealedSessionRuntime.js";
-//#region src/core/signingEngine/session/warmCapabilities/routerAbEd25519WalletSessionState.ts
-function requireNonEmptyStateValue(value, label) {
-	const normalized = String(value).trim();
-	if (!normalized) throw new Error(`${label} is required for Ed25519 Wallet Session state`);
-	return normalized;
-}
-function requirePositiveStateInteger(value, label) {
-	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be positive for Ed25519 Wallet Session state`);
-	return value;
-}
-function buildEmailOtpRouterAbEd25519WalletSessionState(input) {
-	const thresholdSessionId = SigningSessionIds.thresholdEd25519Session(requireNonEmptyStateValue(input.signingWalletSession.thresholdSessionId, "thresholdSessionId"));
-	const walletSessionToken = requireNonEmptyStateValue(input.signingWalletSession.auth.walletSessionToken, "walletSessionToken");
-	const relayerUrl = requireNonEmptyStateValue(input.relayerUrl, "relayerUrl");
-	const providerSubjectId = requireNonEmptyStateValue(input.providerSubjectId, "providerSubjectId");
-	const signerSlot = requirePositiveStateInteger(input.signerSlot, "signerSlot");
-	const remainingUses = requirePositiveStateInteger(input.signingWalletSession.remainingUses, "remainingUses");
-	return {
-		walletSessionAuth: {
-			kind: "wallet_session_opaque",
-			walletSessionToken
-		},
-		walletSessionId: input.signingWalletSession.walletSessionId,
-		quotaId: input.signingWalletSession.quotaId,
-		thresholdSessionId,
-		signingLane: buildNearTransactionSigningLane({
-			walletId: input.walletId,
-			nearAccountId: input.nearAccountId,
-			nearEd25519SigningKeyId: input.nearEd25519SigningKeyId,
-			signerSlot,
-			auth: {
-				kind: "email_otp",
-				providerSubjectId
-			},
-			walletSessionId: input.signingWalletSession.walletSessionId,
-			quotaId: input.signingWalletSession.quotaId,
-			thresholdSessionId,
-			retention: "session",
-			sessionOrigin: "login"
-		}),
-		remainingUses,
-		signingRootId: input.signingWalletSession.signingRootId,
-		signingRootVersion: input.signingWalletSession.signingRootVersion,
-		routerAbNormalSigning: input.signingWalletSession.routerAbNormalSigning,
-		runtimePolicyScope: input.signingWalletSession.runtimePolicyScope,
-		relayerUrl,
-		signingWalletSession: input.signingWalletSession,
-		authority: input.authority
-	};
-}
-function buildPasskeyRouterAbEd25519WalletSessionState(input) {
-	const thresholdSessionId = SigningSessionIds.thresholdEd25519Session(requireNonEmptyStateValue(input.signingWalletSession.thresholdSessionId, "thresholdSessionId"));
-	const walletSessionToken = requireNonEmptyStateValue(input.signingWalletSession.auth.walletSessionToken, "walletSessionToken");
-	const relayerUrl = requireNonEmptyStateValue(input.relayerUrl, "relayerUrl");
-	const credentialIdB64u = requireNonEmptyStateValue(input.credentialIdB64u, "credentialIdB64u");
-	const signerSlot = requirePositiveStateInteger(input.signerSlot, "signerSlot");
-	return {
-		walletSessionAuth: {
-			kind: "wallet_session_opaque",
-			walletSessionToken
-		},
-		walletSessionId: input.signingWalletSession.walletSessionId,
-		quotaId: input.signingWalletSession.quotaId,
-		thresholdSessionId,
-		signingLane: buildNearTransactionSigningLane({
-			walletId: input.walletId,
-			nearAccountId: input.nearAccountId,
-			nearEd25519SigningKeyId: input.nearEd25519SigningKeyId,
-			signerSlot,
-			auth: {
-				kind: "passkey",
-				rpId: input.rpId,
-				credentialIdB64u
-			},
-			walletSessionId: input.signingWalletSession.walletSessionId,
-			quotaId: input.signingWalletSession.quotaId,
-			thresholdSessionId,
-			storageSource: "login"
-		}),
-		remainingUses: input.signingWalletSession.remainingUses,
-		signingRootId: input.signingWalletSession.signingRootId,
-		signingRootVersion: input.signingWalletSession.signingRootVersion,
-		routerAbNormalSigning: input.signingWalletSession.routerAbNormalSigning,
-		runtimePolicyScope: input.signingWalletSession.runtimePolicyScope,
-		relayerUrl,
-		signingWalletSession: input.signingWalletSession,
-		authority: input.authority
-	};
-}
-async function rebindRouterAbEd25519WalletSessionStateFromExactRuntime(args) {
-	const walletSessionToken = args.authorization.operationCredential.token;
-	const authorizationId = args.authorization.session.authorizationId;
-	const exactAuthority = await ed25519SealedRuntimeAuthorityRef({
-		runtime: args.runtime,
-		walletAuthMethodId: args.authorization.selectedAuthMethod.walletAuthMethodId
-	});
-	const selectedFactorAuthorityRef = await walletAuthAuthorityRef({ authority: args.authorization.selectedFactorAuthority });
-	const expiresAtMs = Math.min(args.runtime.expiresAtMs, args.authorization.status.expiresAtMs);
-	if (!walletSessionToken || !authorizationId || args.authorization.session.walletId !== args.runtime.walletId || args.authorization.selectedAuthMethod.kind !== args.runtime.auth.kind || exactAuthority.walletId !== args.runtime.walletId || exactAuthority.walletAuthMethodId !== args.authorization.selectedAuthMethod.walletAuthMethodId || exactAuthority.walletId !== selectedFactorAuthorityRef.walletId || exactAuthority.walletAuthMethodId !== selectedFactorAuthorityRef.walletAuthMethodId || String(exactAuthority.authorityDigest) !== String(selectedFactorAuthorityRef.authorityDigest) || args.authorization.operationCredential.walletSessionId !== args.authorization.status.walletSessionId || expiresAtMs <= args.nowMs) throw new Error("Ed25519 Wallet Session authorization does not match sealed material");
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: args.runtime.walletId,
-		nearAccountId: args.runtime.nearAccountId,
-		nearEd25519SigningKeyId: args.runtime.nearEd25519SigningKeyId,
-		walletSessionId: args.authorization.operationCredential.walletSessionId,
-		authorizationId,
-		quotaId: args.authorization.session.quotaId,
-		thresholdSessionId: args.runtime.thresholdSessionId,
-		remainingUses: Math.min(args.runtime.remainingUses, args.authorization.status.remainingUses),
-		expiresAtMs,
-		runtimePolicyScope: args.runtime.runtimePolicyScope,
-		signingRootId: args.runtime.signingRootId,
-		signingRootVersion: args.runtime.signingRootVersion,
-		routerAbNormalSigning: args.runtime.routerAbNormalSigning,
-		walletSessionToken,
-		nowMs: args.nowMs
-	});
-	if (!signingWalletSession.ok) throw new Error(`Ed25519 Wallet Session runtime is invalid: ${signingWalletSession.reason}`);
-	if (args.runtime.factor.kind === "passkey" && args.runtime.auth.kind === "passkey") return buildPasskeyRouterAbEd25519WalletSessionState({
-		walletId: args.runtime.walletId,
-		nearAccountId: args.runtime.nearAccountId,
-		nearEd25519SigningKeyId: args.runtime.nearEd25519SigningKeyId,
-		signerSlot: args.runtime.signerSlot,
-		rpId: args.runtime.factor.rpId,
-		credentialIdB64u: args.runtime.factor.credentialIdB64u,
-		relayerUrl: args.runtime.relayerUrl,
-		authority: exactAuthority,
-		signingWalletSession: signingWalletSession.value
-	});
-	if (args.runtime.factor.kind === "email_otp" && args.runtime.auth.kind === "email_otp") return buildEmailOtpRouterAbEd25519WalletSessionState({
-		walletId: args.runtime.walletId,
-		nearAccountId: args.runtime.nearAccountId,
-		nearEd25519SigningKeyId: args.runtime.nearEd25519SigningKeyId,
-		providerSubjectId: args.runtime.auth.providerSubjectId,
-		signerSlot: args.runtime.signerSlot,
-		relayerUrl: args.runtime.relayerUrl,
-		authority: exactAuthority,
-		signingWalletSession: signingWalletSession.value
-	});
-	throw new Error("Ed25519 sealed runtime factor and auth binding disagree");
-}
-function nearEd25519YaoOperationMaterialFacts(state) {
-	return {
-		thresholdSessionId: state.thresholdSessionId,
-		signer: state.signingLane.identity.signer,
-		signingRootId: state.signingRootId,
-		signingRootVersion: state.signingRootVersion,
-		routerAbNormalSigning: state.routerAbNormalSigning,
-		runtimePolicyScope: state.runtimePolicyScope,
-		relayerUrl: state.relayerUrl
-	};
-}
-function hasExactEd25519SigningSubject(args) {
-	return args.authorization.capabilitySubjects.some((subject) => subject.kind === "sign" && subject.keyFamily === "ed25519" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation));
-}
-function authorizeRouterAbEd25519WalletSessionState(args) {
-	const state = args.state;
-	const authorization = args.authorization;
-	const walletId = state.signingLane.identity.signer.account.wallet.walletId;
-	const walletSessionToken = args.operationCredential.token;
-	const signer = state.signingLane.identity.signer;
-	const effectiveExpiresAtMs = Math.min(state.signingWalletSession.expiresAtMs, authorization.expiresAtMs);
-	if (!walletSessionToken || !hasExactEd25519SigningSubject({
-		authorization,
-		materialActivation: args.materialActivation
-	}) || authorization.walletId !== walletId || authorization.authMethodId !== state.authority.walletAuthMethodId || args.operationCredential.walletSessionId !== state.walletSessionId || authorization.authorizationId !== state.signingWalletSession.authorizationId || effectiveExpiresAtMs <= args.nowMs || !Number.isSafeInteger(effectiveExpiresAtMs)) return null;
-	const signingWalletSession = buildRouterAbEd25519SigningWalletSession({
-		walletId: String(signer.account.wallet.walletId),
-		nearAccountId: String(signer.account.nearAccountId),
-		nearEd25519SigningKeyId: String(signer.nearEd25519SigningKeyId),
-		walletSessionId: String(state.walletSessionId),
-		authorizationId: String(state.signingWalletSession.authorizationId),
-		quotaId: String(state.quotaId),
-		thresholdSessionId: String(state.thresholdSessionId),
-		remainingUses: state.remainingUses,
-		expiresAtMs: effectiveExpiresAtMs,
-		runtimePolicyScope: state.runtimePolicyScope,
-		signingRootId: state.signingRootId,
-		signingRootVersion: state.signingRootVersion,
-		routerAbNormalSigning: state.routerAbNormalSigning,
-		walletSessionToken,
-		nowMs: args.nowMs
-	});
-	if (!signingWalletSession.ok) return null;
-	switch (state.signingLane.auth.kind) {
-		case "passkey": return {
-			...buildPasskeyRouterAbEd25519WalletSessionState({
-				walletId: signer.account.wallet.walletId,
-				nearAccountId: signer.account.nearAccountId,
-				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-				signerSlot: signer.signerSlot,
-				rpId: state.signingLane.auth.rpId,
-				credentialIdB64u: state.signingLane.auth.credentialIdB64u,
-				relayerUrl: state.relayerUrl,
-				authority: state.authority,
-				signingWalletSession: signingWalletSession.value
-			}),
-			walletSessionAuthorization: authorization,
-			walletSessionOperationCredential: args.operationCredential
-		};
-		case "email_otp": return {
-			...buildEmailOtpRouterAbEd25519WalletSessionState({
-				walletId: signer.account.wallet.walletId,
-				nearAccountId: signer.account.nearAccountId,
-				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
-				providerSubjectId: state.signingLane.auth.providerSubjectId,
-				signerSlot: signer.signerSlot,
-				relayerUrl: state.relayerUrl,
-				authority: state.authority,
-				signingWalletSession: signingWalletSession.value
-			}),
-			walletSessionAuthorization: authorization,
-			walletSessionOperationCredential: args.operationCredential
-		};
-		default: return assertNeverSigningLaneAuth(state.signingLane.auth);
-	}
-}
-function assertNeverSigningLaneAuth(value) {
-	throw new Error(`Unknown Ed25519 signing lane auth: ${String(value)}`);
-}
-async function resolveActiveAuthorizedRouterAbEd25519WalletSessionState(args) {
-	const walletId = args.state.signingLane.identity.signer.account.wallet.walletId;
-	const credential = await resolveExactWalletSessionOperationCredential({
-		ports: args.ports,
-		input: {
-			walletId,
-			authMethod: signingLaneAuthMethod(args.state.signingLane.auth),
-			walletSessionId: args.state.walletSessionId,
-			quotaId: args.state.quotaId,
-			requiredSigningSubject: requiredSigningSubjectForExactSigningLane(args.state.signingLane.identity),
-			expiry: {
-				kind: "unexpired",
-				nowMs: args.nowMs
-			}
-		}
-	});
-	if (credential.kind !== "resolved" || credential.resolved.authMethod.walletAuthMethodId !== args.state.authority.walletAuthMethodId) return null;
-	return authorizeRouterAbEd25519WalletSessionState({
-		state: args.state,
-		authorization: credential.resolved.session,
-		operationCredential: credential.resolved.operationCredential,
-		materialActivation: credential.resolved.materialActivation,
-		nowMs: args.nowMs
-	});
-}
-//#endregion
-export { buildEmailOtpRouterAbEd25519WalletSessionState, buildPasskeyRouterAbEd25519WalletSessionState, nearEd25519YaoOperationMaterialFacts, rebindRouterAbEd25519WalletSessionStateFromExactRuntime, resolveActiveAuthorizedRouterAbEd25519WalletSessionState };
-
-//# sourceMappingURL=routerAbEd25519WalletSessionState.js.map

package/dist/esm/react/core/signingEngine/session/warmCapabilities/routerAbWalletSessionCredential.js

@@ -1,73 +0,0 @@
-//#region src/core/signingEngine/session/warmCapabilities/routerAbWalletSessionCredential.ts
-function requireNonEmpty(value, label) {
-	const parsed = String(value || "").trim();
-	if (!parsed) throw new Error(`Router A/B Ed25519 normal-signing ready state is missing ${label}`);
-	return parsed;
-}
-function requireEqual(actual, expected, label) {
-	if (actual !== expected) throw new Error(`Router A/B Ed25519 normal-signing ready state ${label} mismatch`);
-}
-function requireFutureEpochMs(value, label) {
-	const parsed = Math.floor(Number(value));
-	if (!Number.isFinite(parsed) || parsed <= Date.now()) throw new Error(`Router A/B Ed25519 normal-signing ready state ${label} is expired`);
-	return parsed;
-}
-function requirePositiveInteger(value, label) {
-	const parsed = Math.floor(Number(value));
-	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw new Error(`Router A/B Ed25519 normal-signing ready state ${label} is exhausted`);
-	return parsed;
-}
-function requireRouterAbEd25519NormalSigningReadyState(args) {
-	const state = args.state;
-	const signingWalletSession = state.signingWalletSession;
-	const thresholdSessionId = requireNonEmpty(args.thresholdSessionId, "thresholdSessionId");
-	const stateThresholdSessionId = requireNonEmpty(state.thresholdSessionId, "state.thresholdSessionId");
-	const laneThresholdSessionId = requireNonEmpty(state.signingLane.thresholdSessionId, "state.signingLane.thresholdSessionId");
-	requireEqual(stateThresholdSessionId, thresholdSessionId, "thresholdSessionId");
-	requireEqual(laneThresholdSessionId, thresholdSessionId, "lane thresholdSessionId");
-	const walletSessionId = requireNonEmpty(state.walletSessionId, "state.walletSessionId");
-	const quotaId = requireNonEmpty(state.quotaId, "state.quotaId");
-	requireEqual(state.signingLane.walletSessionId, walletSessionId, "lane walletSessionId");
-	requireEqual(state.signingLane.quotaId, quotaId, "lane quotaId");
-	const nearAccountId = requireNonEmpty(args.nearAccountId, "nearAccountId");
-	requireNonEmpty(state.signingLane.identity.signer.account.wallet.walletId, "state.signingLane.identity.signer.account.wallet.walletId");
-	requireEqual(requireNonEmpty(args.thresholdKeyMaterial.nearAccountId, "thresholdKeyMaterial.nearAccountId"), nearAccountId, "threshold key accountId");
-	const routerAbState = signingWalletSession.routerAbNormalSigning;
-	const runtimePolicyScope = signingWalletSession.runtimePolicyScope;
-	const walletSessionToken = requireNonEmpty(signingWalletSession.auth.walletSessionToken, "Wallet Session bearer token");
-	const signingRootId = requireNonEmpty(state.signingRootId, "state.signingRootId");
-	const signingRootVersion = requireNonEmpty(state.signingRootVersion, "state.signingRootVersion");
-	requireEqual(signingWalletSession.thresholdSessionId, thresholdSessionId, "Wallet Session thresholdSessionId");
-	requireEqual(signingWalletSession.walletSessionId, walletSessionId, "Wallet Session walletSessionId");
-	requireEqual(signingWalletSession.quotaId, quotaId, "Wallet Session quotaId");
-	requireEqual(signingWalletSession.signingRootId, signingRootId, "signingRootId");
-	requireEqual(signingWalletSession.signingRootVersion, signingRootVersion, "signingRootVersion");
-	requireEqual(state.routerAbNormalSigning.signingWorkerId, routerAbState.signingWorkerId, "signingWorkerId");
-	const expiresAtMs = requireFutureEpochMs(signingWalletSession.expiresAtMs, "expiresAtMs");
-	const remainingUses = requirePositiveInteger(signingWalletSession.remainingUses, "remainingUses");
-	if (state.remainingUses !== remainingUses) throw new Error("Router A/B Ed25519 normal-signing ready state remainingUses mismatch");
-	return {
-		kind: "router_ab_ed25519_normal_signing_ready_state_v1",
-		walletSessionId,
-		quotaId,
-		thresholdSessionId,
-		nearAccountId,
-		relayerUrl: requireNonEmpty(state.relayerUrl, "relayerUrl"),
-		routerAbNormalSigning: routerAbState,
-		signingWorkerId: requireNonEmpty(routerAbState.signingWorkerId, "signingWorkerId"),
-		signerPublicKey: requireNonEmpty(args.thresholdKeyMaterial.publicKey, "signerPublicKey"),
-		signingRootId,
-		signingRootVersion,
-		remainingUses,
-		expiresAtMs,
-		runtimePolicyScope,
-		credential: {
-			kind: "wallet_session_opaque",
-			walletSessionToken
-		}
-	};
-}
-//#endregion
-export { requireRouterAbEd25519NormalSigningReadyState };
-
-//# sourceMappingURL=routerAbWalletSessionCredential.js.map

package/dist/esm/react/core/signingEngine/session/warmCapabilities/sealedRefreshParity.js

@@ -1,67 +0,0 @@
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { thresholdEcdsaChainTargetKey } from "../../interfaces/ecdsaChainTarget.js";
-//#region src/core/signingEngine/session/warmCapabilities/sealedRefreshParity.ts
-function isRetryableSealedRefreshCapabilityFetchError(error) {
-	const code = error && typeof error === "object" && "code" in error ? String(error.code || "").trim() : "";
-	if (code === "sealed_refresh_parity_fetch_failed" || code === "sealed_refresh_parity_http_error" || code === "sealed_refresh_parity_aborted") return true;
-	const message = String(error instanceof Error ? error.message : error || "");
-	return message.includes("Failed to fetch relayer well-known capabilities") || /Well-known endpoint returned HTTP 5\d\d/.test(message);
-}
-function parityErrorMessage(error) {
-	return error instanceof Error ? error.message : String(error || "unknown error");
-}
-async function ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap(ensureParity, args) {
-	try {
-		await ensureParity();
-	} catch (error) {
-		if (args.kind === "key_enrollment_bootstrap_parity") {
-			console.warn("[threshold-ecdsa] key enrollment bootstrap skipped sealed-refresh startup parity enforcement", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "transaction_bootstrap_parity" && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] transaction bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "email_otp_bootstrap_parity" && args.authMethod === SIGNER_AUTH_METHODS.emailOtp && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] Email OTP bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "default_bootstrap_parity" && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] default bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		throw error;
-	}
-}
-async function ensureSealedRefreshStartupParityForTransactionSigning(ensureParity, args) {
-	try {
-		await ensureParity();
-	} catch (error) {
-		if (!isRetryableSealedRefreshCapabilityFetchError(error)) throw error;
-		console.warn("[threshold-ecdsa] transaction signing skipped retryable sealed-refresh capability fetch failure", {
-			walletId: String(args.walletId || "").trim(),
-			chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-			error: parityErrorMessage(error)
-		});
-	}
-}
-//#endregion
-export { ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap, ensureSealedRefreshStartupParityForTransactionSigning, isRetryableSealedRefreshCapabilityFetchError };
-
-//# sourceMappingURL=sealedRefreshParity.js.map

package/dist/esm/react/core/signingEngine/session/warmCapabilities/statusReader.js

@@ -1,100 +0,0 @@
-import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
-import { ed25519AuthorizationIdentityMatchesRuntime } from "./ed25519SealedSessionRuntime.js";
-import { normalizeWarmSessionReadPorts, readWarmSessionClaim, toSigningSessionStatus, toWarmSessionClaimFromStatusResult } from "./readModel.js";
-//#region src/core/signingEngine/session/warmCapabilities/statusReader.ts
-function ed25519SessionMetadata(runtime) {
-	switch (runtime.factor.kind) {
-		case SIGNER_AUTH_METHODS.passkey: return { authMethod: SIGNER_AUTH_METHODS.passkey };
-		case SIGNER_AUTH_METHODS.emailOtp: return {
-			authMethod: SIGNER_AUTH_METHODS.emailOtp,
-			retention: "session"
-		};
-		default:
-			runtime.factor;
-			throw new Error("[WarmSessionStore] unsupported Ed25519 runtime factor");
-	}
-}
-async function ed25519AuthorizationMatchesRuntime(args) {
-	return ed25519AuthorizationIdentityMatchesRuntime({
-		runtime: args.runtime,
-		authorization: args.authorization
-	});
-}
-function createWarmSessionStatusReader(deps) {
-	const touchConfirm = normalizeWarmSessionReadPorts(deps.touchConfirm);
-	async function readEd25519WarmSessionClaim(runtime) {
-		const thresholdSessionId = String(runtime.thresholdSessionId);
-		return await readEd25519WarmSessionClaimByMethod({
-			authMethod: runtime.factor.kind,
-			thresholdSessionId,
-			materialActivation: runtime.sealedRecord.ed25519Restore.materialActivation
-		});
-	}
-	async function readEd25519WarmSessionClaimByMethod(args) {
-		if (args.authMethod === SIGNER_AUTH_METHODS.emailOtp) {
-			const status = await deps.getEmailOtpWarmSessionStatus({
-				kind: "ed25519_yao",
-				thresholdSessionId: args.thresholdSessionId,
-				materialActivation: args.materialActivation
-			}).catch(() => ({
-				ok: false,
-				code: "worker_error",
-				message: "worker_error"
-			}));
-			return toWarmSessionClaimFromStatusResult({
-				thresholdSessionId: args.thresholdSessionId,
-				status
-			});
-		}
-		return await readWarmSessionClaim(touchConfirm, args.thresholdSessionId);
-	}
-	async function getEd25519SigningSessionStatus(args) {
-		const runtime = args.runtime;
-		const thresholdSessionId = String(runtime.thresholdSessionId);
-		const metadata = ed25519SessionMetadata(runtime);
-		if (!args.authorization || !await ed25519AuthorizationMatchesRuntime({
-			runtime,
-			authorization: args.authorization
-		})) return {
-			sessionId: thresholdSessionId,
-			status: "unavailable",
-			statusCode: "auth_missing",
-			...metadata
-		};
-		if (args.authorization.status.expiresAtMs <= args.nowMs || runtime.expiresAtMs <= args.nowMs) return {
-			sessionId: thresholdSessionId,
-			status: "expired",
-			expiresAtMs: Math.min(args.authorization.status.expiresAtMs, runtime.expiresAtMs),
-			...metadata
-		};
-		if (runtime.remainingUses <= 0) return {
-			sessionId: thresholdSessionId,
-			status: "exhausted",
-			remainingUses: 0,
-			expiresAtMs: runtime.expiresAtMs,
-			...metadata
-		};
-		const status = toSigningSessionStatus({
-			sessionId: thresholdSessionId,
-			claim: await readEd25519WarmSessionClaim(runtime),
-			authMethod: metadata.authMethod,
-			retention: metadata.retention ?? null
-		});
-		if (status.status === "not_found") return {
-			sessionId: thresholdSessionId,
-			status: "active",
-			remainingUses: runtime.remainingUses,
-			expiresAtMs: runtime.expiresAtMs,
-			...metadata
-		};
-		return status;
-	}
-	return {
-		getEd25519SigningSessionStatus,
-		readEd25519WarmSessionClaim
-	};
-}
-//#endregion
-export { createWarmSessionStatusReader };
-
-//# sourceMappingURL=statusReader.js.map

package/dist/esm/react/core/signingEngine/session/warmCapabilities/transitions.js

@@ -1,51 +0,0 @@
-//#region src/core/signingEngine/session/warmCapabilities/transitions.ts
-function summarizeWarmSessionCapabilityTransition(capability) {
-	const rawSessionId = capability.capability === "ecdsa" ? capability.runtime?.sealedRecord.thresholdSessionId : capability.runtime?.thresholdSessionId;
-	const thresholdSessionId = rawSessionId ? String(rawSessionId).trim() : null;
-	return {
-		state: capability.state,
-		thresholdSessionId: thresholdSessionId || null,
-		authState: capability.auth ? "present" : "missing",
-		prfClaimState: capability.prfClaim?.state || null,
-		...capability.prfClaim?.state === "warm" ? {
-			remainingUses: capability.prfClaim.remainingUses,
-			expiresAtMs: capability.prfClaim.expiresAtMs
-		} : {}
-	};
-}
-function summarizeWarmSessionTransition(envelope) {
-	return {
-		walletId: envelope.walletId,
-		capabilities: {
-			ed25519: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ed25519),
-			ecdsa: {
-				evm: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.evm),
-				tempo: summarizeWarmSessionCapabilityTransition(envelope.capabilities.ecdsa.tempo)
-			}
-		},
-		updatedAtMs: envelope.updatedAtMs
-	};
-}
-function emitWarmSessionTransition(args) {
-	if (typeof args.onTransition !== "function") return;
-	try {
-		const pending = args.onTransition(args.event);
-		if (pending && typeof pending.then === "function") Promise.resolve(pending).catch((error) => {
-			console.warn("[WarmSessionStore] warm-session transition callback failed", {
-				type: args.event.type,
-				walletId: args.event.walletId,
-				error
-			});
-		});
-	} catch (error) {
-		console.warn("[WarmSessionStore] warm-session transition callback failed", {
-			type: args.event.type,
-			walletId: args.event.walletId,
-			error
-		});
-	}
-}
-//#endregion
-export { emitWarmSessionTransition, summarizeWarmSessionTransition };
-
-//# sourceMappingURL=transitions.js.map

package/dist/esm/react/core/signingEngine/session/warmCapabilities/types.js

@@ -1,122 +0,0 @@
-import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
-import { laneCandidateStateFromRuntimePolicy } from "../identity/laneIdentity.js";
-//#region src/core/signingEngine/session/warmCapabilities/types.ts
-function expectedPresentCapabilityState(args) {
-	const { capability } = args;
-	if (!capability.auth || !args.hasWalletSessionAuthorization) return capability.capability === "ed25519" ? "authorization_required" : "auth_missing";
-	if (args.emailOtpSingleUseConsumed) return "prf_missing";
-	const prfClaim = capability.prfClaim;
-	if (capability.capability === "ed25519") {
-		const runtimeState = laneCandidateStateFromRuntimePolicy({
-			remainingUses: capability.runtime.remainingUses,
-			expiresAtMs: capability.runtime.expiresAtMs
-		});
-		if (runtimeState === "expired" || runtimeState === "exhausted") return "authorization_required";
-		if (prfClaim?.state === "unavailable") return "prf_unavailable";
-		if (prfClaim?.state !== "warm") return "prf_missing";
-		return "ready";
-	}
-	const runtimeState = laneCandidateStateFromRuntimePolicy({
-		remainingUses: capability.runtime.remainingUses,
-		expiresAtMs: capability.runtime.expiresAtMs
-	});
-	if (runtimeState === "expired" || runtimeState === "exhausted") return "authorization_required";
-	if (!prfClaim) return "prf_missing";
-	if (prfClaim.state === "unavailable") return "prf_unavailable";
-	if (prfClaim.state !== "warm") return "prf_missing";
-	return "ready";
-}
-function assertEd25519CapabilityStateInvariant(args) {
-	const { capability } = args;
-	const runtime = capability.runtime;
-	const auth = capability.auth;
-	const prfClaim = capability.prfClaim;
-	const thresholdSessionId = String(runtime?.thresholdSessionId || "").trim();
-	if (!runtime) {
-		if (capability.state !== "missing" && capability.state !== "invalid") throw new Error(`[WarmSessionStore] invalid ${args.label} capability: missing runtime must be missing or invalid`);
-		if (auth) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: missing runtime cannot have auth`);
-		if (prfClaim) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: missing runtime cannot have warm-session status`);
-		return;
-	}
-	if (String(runtime.walletId) !== String(args.walletId)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: runtime wallet does not match envelope wallet`);
-	if (!thresholdSessionId) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: runtime is missing thresholdSessionId`);
-	if (auth) {
-		if (String(auth.session.walletId) !== String(runtime.walletId)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: authorization wallet does not match runtime`);
-		if (auth.selectedAuthMethod.kind !== runtime.factor.kind) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: authorization factor does not match runtime`);
-	}
-	if (prfClaim) {
-		if (String(prfClaim.thresholdSessionId || "").trim() !== thresholdSessionId) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: warm-session status thresholdSessionId does not match record thresholdSessionId`);
-		switch (prfClaim.state) {
-			case "warm":
-				if (prfClaim.remainingUses <= 0 || prfClaim.expiresAtMs <= 0) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: warm warm-session status requires positive remainingUses and expiresAtMs`);
-				break;
-			case "unavailable":
-				if (!String(prfClaim.code || "").trim()) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: unavailable warm-session status requires a code`);
-				break;
-			case "missing":
-			case "expired":
-			case "exhausted": break;
-			default: throw new Error("[WarmSessionStore] unsupported warm-session claim state");
-		}
-	}
-	const expectedState = expectedPresentCapabilityState({
-		capability,
-		hasWalletSessionAuthorization: Boolean(auth),
-		emailOtpSingleUseConsumed: false
-	});
-	if (capability.state !== expectedState) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: state=${capability.state} does not match derived state=${expectedState}`);
-}
-function assertEcdsaCapabilityStateInvariant(args) {
-	const { capability } = args;
-	const runtime = capability.runtime;
-	const publicFacts = capability.manifest.durableMaterial.roleLocalPublicFacts;
-	if (String(runtime.walletId) !== String(args.walletId)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: runtime wallet does not match envelope wallet`);
-	if (String(capability.key.walletId) !== String(args.walletId)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: key wallet does not match envelope wallet`);
-	if (String(capability.key.thresholdOwnerAddress).toLowerCase() !== String(publicFacts.ethereumAddress).toLowerCase()) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: key owner address does not match manifest public facts`);
-	if (capability.state === "authorization_required") {
-		if (capability.lane) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: authorization_required cannot carry a lane`);
-		return;
-	}
-	if (!capability.lane) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: authorized ECDSA capability requires a lane`);
-	if (!thresholdEcdsaChainTargetsEqual(capability.lane.identity.signer.chainTarget, runtime.chainTarget)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: lane chain target does not match runtime chain target`);
-	if (String(capability.lane.materialActivation.activationId) !== String(runtime.materialActivation.activationId)) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: lane material activation does not match runtime`);
-	if (signingLaneAuthMethod(capability.lane.auth) !== runtime.authBinding.kind) throw new Error(`[WarmSessionStore] invalid ${args.label} capability: lane authMethod does not match sealed auth binding`);
-	if (capability.emailOtpAuthContext && runtime.authBinding.kind !== "email_otp") throw new Error(`[WarmSessionStore] invalid ${args.label} capability: non-email_otp binding cannot carry email-otp auth context`);
-}
-function assertCapabilityStateInvariant(args) {
-	const { capability } = args;
-	if (capability.state === "missing") return;
-	if (capability.capability === "ecdsa") {
-		if (capability.state === "invalid") return;
-		assertEcdsaCapabilityStateInvariant({
-			walletId: args.walletId,
-			label: args.label,
-			capability
-		});
-		return;
-	}
-	assertEd25519CapabilityStateInvariant(args);
-}
-function assertWarmSessionEnvelopeInvariant(envelope) {
-	assertCapabilityStateInvariant({
-		walletId: envelope.walletId,
-		label: "ed25519",
-		capability: envelope.capabilities.ed25519
-	});
-	assertCapabilityStateInvariant({
-		walletId: envelope.walletId,
-		label: "ecdsa.evm",
-		capability: envelope.capabilities.ecdsa.evm
-	});
-	assertCapabilityStateInvariant({
-		walletId: envelope.walletId,
-		label: "ecdsa.tempo",
-		capability: envelope.capabilities.ecdsa.tempo
-	});
-	return envelope;
-}
-//#endregion
-export { assertWarmSessionEnvelopeInvariant };
-
-//# sourceMappingURL=types.js.map